Function origin_ok 

pub fn origin_ok(port: u16, method: &Method, headers: &HeaderMap) -> bool

A request that changes something comes from this origin: browsers send Origin on every non-GET fetch, so a cross-site form or script is refused even if it guessed the token.