Chrome and Safari send the Origin header on same origin header.

Origin and Host must be different for the request to be considered CORS request.