Only block requests from non-whitelisted origins if they start with HTTP
Fixes issue where Postman no longer works with Sails, due to it sending a "chrome://" origin header.