Favour TENT_HOST_DOMAIN in safe_origin check