Fixes when browser doesn't send origin header, defaults to empty string instead of UNDEFINED (which would throw an error on the origin.match(/^https/) below