basic security

not really secure - Origin can be spoofed easily.