Origin host

Validate the Origin header to prevent CSRF attacks