checks origin properly before allowing cookies