Origin check tolerates http:// and http://www.