Comment by zwnow

Also cant you just spoof the origin header?