I see your point, but you're saying: > Yeah, we don't trust just anything that comes in on that socket Well, you are, you're trusting it came from a browser s

I see your point, but you're saying: > Yeah, we don't trust just anything that comes in on that socket Well, you are, you're trusting it came from a browser so the Origin header is correct, right?