Neaten this up a bit
'*' allowed domain now allows no Referer/Origin to be set