port check_origin from 4.x to 3.1