Bug 1098664 - allows non-privileged app to specify a custom origin. r=rickychien