I've added the Origin header to all non-GET browsing context navigation and to ping="" processing. http://html5.org/tools/web-apps-tracker?from=2524&to=2525 -- Ian Hickson U+1047E )\._.,--....,'``. fL http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,. Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'