correct origin header check