add id-sk-origin validation to workaround gangway assumptions