Remove 403 on non-OPTIONS requests that have an invalid origin header

It is not the bundles job to handle insecure client implementations