title: Chrome adding Origin header to same-origin request
body: <p>We're POSTing an AJAX request to a server running locally, i.e.</p>
  
  <pre><code>xhr.open("POST", "http://localhost:9000/context/request");
  xhr.addHeader(someCustomHeaders);
  xhr.send(someData);
  </code></pre>
  
  <p>The page that this javascript is being executed is also being served from localhost:9000, i.e. this totally looks like a same-origin request.</p>
  
  <p>However, for some reason, Google Chrome always sets an Origin header in the resulting request, causing our server to block the request based on the false assumption that it's CORS request. </p>
  
  <p>This does not happen in Firefox.</p>
  
  <p>Also, neither Firefox nor Chrome are sending an OPTIONS preflight request, which is confusing; why set an Origin header without first preflighting to make sure the the Origin and the Custom headers are allowed by the server?</p>
  
  <p>Does anyone know what is going on in this case? Are we misunderstanding the CORS spec?</p>