title: What HTTP origin does GM_xmlhttpRequest send?
body: <p>I want my app with a REST API to be accessible in different flavors:</p>
  
  <ul>
  <li>From the same domain (use normal AJAX request here)</li>
  <li>From another domain via script attached by site owner (CORS)</li>
  <li>From another domain via userscript (GM_xmlhttpRequest (?))</li>
  </ul>
  
  <p>I want to limit the list of sites for my app to be accessible from by a whitelist. </p>
  
  <p>I know how to do it with CORS but I'm not sure if it works with <code>GM_xmlhttpRequest</code> the same way since <code>GM_xmlhttpRequest</code> does not require the <code>Origin</code> header to be sent back from a server. </p>
  
  <p>I don't care for a client but I still need to check on a server from which site the request was sent and answer with something like <code>{response:"site not supported"}</code> if it isn't in a whitelist.</p>
  
  <p>So, when I run a userscript on some webpage and make a <code>GM_xmlhttpRequest</code>, can the server detect the origin?</p>