Track request origin only on /api endpoints