api requests only fail on bad origin in live mode