spoof http origin header

[tyngdekraften]

https://skyfallattack.com/

GET /s/montserrat/v12/IVeH6A3MiFyaSEiudUMXE8u2Q0OS-KeTAWjgkS85mDg.woff2
Host: fonts.gstatic.com
Referer: https://fonts.gstatic.com/
Origin: https://skyfallattack.com

in this context origin is useless and used for tracking while modifying it does not break anything
#358 (comment)

[ssokolow]

Spoofing it to the spec-defined null value (The value used for file:// URLs where null != null) should be safe, though it's possible some sites might decide that blocking use from file:// URLs is acceptable.