Origin ACL check should first make sure there are policies for origin URIs.