use the host header instead of origin (as origin is sometimes missing)