Port the check_origin code from Tornado 4.x to 3.2