Authentication with origin instead of server:port