Minor security issue with origin checks

[jamesvl]

I've come across a minor issue in origin checks - it's probably not exploitable in the wild, but I cannot be sure of that.

Should I report that here, or do you have an email for security-related issues I can use?