Chrome/safari adds the Origin header in same-origin post/put/delete

requests, causes api requests to fail. Origin is the proxy anyway not
the browser. Tested and api requests now work.