added origin checks to service manifest load
added origin checks for dataAction, changed docs accordingly