Reject requests whose Origin header is not on the allowlist.
Origin
Allowed origin hostnames (port-agnostic).
When true, skip GET/HEAD (view asset GETs).
Reject requests whose
Originheader is not on the allowlist.