API: Add "standard" header and hook for lacksSameOriginSecurity()