LEDGE-252: facilities for validating request origin for CORS