ensure window.location.origin