add for now disabled tests for writing outside of the scoped and user directory, add Origin header to requests