Fixed a bug that always allowed access for Origin.
Added tests for Origin ACL.