Fallback to comparing origin headers for referrer checks.

This really isn't he same thing, so this should be revisited, but this
is a stopgap to let us implement referer checks on IE8-9 pseudo CORS
support.
Merge remote-tracking branch 'origin/master' into config