disabled http_origin protection, fix of dashboard rewrite