does not allow 'null' origin header