https://wiki.mozilla.org/Security/Origin indicates some ways you can make an Origin header be present or absent