brought back x-origin, added 'valid x-origin' rules, automated generation and use