=== GET /ws handshake, varying only the Origin header ===
no Origin header          -> HTTP/1.1 101
Origin: http://localhost  -> HTTP/1.1 101
Origin: https://evil...   -> HTTP/1.1 403