Correctly handle missing origin URL.

As the [docs for nsIContentPolicy#shouldLoad](https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIContentPolicy#shouldLoad%28%29) say, `aRequestOrigin` can be null. One example for this is the first page load when the browser starts.

The attached commit simply checks for null before trying to access `org`.