The origin Drupal renders against, which is not simply the Host header (a forged host could
move a password-reset link or poison a path-keyed cache), so it is a property of the site.
Order: SITE_ORIGIN (deploy time, wins outright), the pin in cfw_meta (trust on first use,
re-pinned by /firstrun), the observed origin, then http://localhost.
The origin Drupal renders against, which is not simply the
Hostheader (a forged host could move a password-reset link or poison a path-keyed cache), so it is a property of the site.Order:
SITE_ORIGIN(deploy time, wins outright), the pin incfw_meta(trust on first use, re-pinned by/firstrun), the observed origin, thenhttp://localhost.