closes getlantern/lantern#1098

How's this look guys?

Tested [the CSRF attack I wrote last week](https://lantern-attacker.appspot.com/admin/csrf.html) against it and the origin header check was sufficient to ward it off:

![screen shot 2013-10-31 at 11 56 52 am](https://f.cloud.github.com/assets/475147/1447317/27d39238-4245-11e3-84ce-1f19f204e6c0.png)