Function origin_allowed 

pub fn origin_allowed(headers: &HeaderMap, extras: &[String]) -> bool

Returns true when the request’s Origin header is on the default allow-list, on the extras list (verbatim match), or absent. Used by the /mcp handler as the first gate before bearer auth.