Fallback to comparing origin headers for referrer checks.

This really isn't he same thing, so this should be revisited, but this
is a stopgap to let us implement referer checks on IE8-9 pseudo CORS
support.
Merge branch 'master' into gsa