The check_origin method should receive the entire Origin header, not just the netloc portion.  Some applications may want to implement controls that are finer-grained than the host-port level.  Perhaps there should be a `match_origin(origin_url, expected_host_port)` (or `expected_host_port_list`?) function and the url parsing could happen in there.  

I'm also concerned about discarding the scheme.  It's possible (but unnatural) to run both HTTP and HTTPS on the same port and switch based on whether the incoming data looks like an HTTP request or an SSL handshake.  I can't immediately see any problems with treating http://example.com:443 as equivalent to https://example.com:443, but if we treat http://example.com:80 as distinct from https://example.com:443 we should probably do the same when the two schemes are hosted on the same port.