Some browsers include the "Origin" header for non-CORS same-origin requests.  This is legal according to RFC 6454-7.3.  So we are comparing the "Host" header with the "Origin" header to determine same-origin.