Update the default origin test to treat no origin specified as OK. If the client can create a request without the origin set, then the client can also create a request with an arbitrary origin.