Origin is an HTTP header, not a request parameter