PASS: Cross-domain access allowed.
HTTP_ORIGIN: