Adding a paragraph to explain that the Origin header may not necessarily be from a different origin.

I recently discovered that some same-origin requests may still have an Origin header. This may create issues when validating a list of origins. Added a paragraph to explain this.