Reject bad ;orig, and set it correctly ourselves.

;orig can only be set by a known client; other instances are
illegal.

When we set it ourselves, only do it when we are doing it on
behalf of a known client.
UTs, proper trust boundary handling, and comments.

More detailed comments about IBCF ;orig.
Apply review markups.

Clearer to look up the topmost route header again, rather than
relying on a fragile assignment to a local variable a long way
above.
Merge pull request #24 from Metaswitch/ibcf-orig

[Reviewer: Mike] IBCF ;orig handling