pub fn origin_allowed(req: &Request) -> bool
A cookie-authenticated upgrade must come from a page on this site. A bearer token is not sent by browsers on their own, so it needs no Origin.