Fix for #880 by implementing simple same origin policy logic and making it an optional configuration