The origin and host header are both provided by the browser. I'm not sure what you want to test here.