check the header first in order to allow the correct origin