use host header, not origin header.