The Origin header shouldn't ever be a non-absolute URL.

However, this is opposite the behavior of letting a lack of Origin pass. We need to pick one or the other.