I said this in the post, but I want to make it clear here: the Origin header is not a panacea for CSRF. There are plenty of other elements that can render it us

I said this in the post, but I want to make it clear here: the Origin header is not a panacea for CSRF. There are plenty of other elements that can render it useless as a form of protection, which I spell out in the post itself. However, it's definitely a cool use of the header (and one that I hadn't seen discussed before). :)