Can the Origin header ever be a non-absolute URL?  Off the top of my head I'd say that if the Origin header is present but does not start with "http://" or "https://" we should just reject the request, since it does not contain a hostname in a form we can positively identify.