Better origin header handling. works for https