using HTTP_ORIGIN instead of request_hostname