pub fn origin_allowed(req: &Request) -> bool
The unix socket and bearer tokens need no Origin; a cookie needs one naming this site, as for the terminal. An Origin that is there must name this site, whatever the transport.
Origin