I agree that to do proper origin validation we need to have an explicit list of acceptable origin values.