It's the `Origin` header that's the issue, not `Refer(r)er`.