mw.ForeignApi: don’t set origin for same-origin requests