title: Origin header null for XHR request made from <iframe> with sandbox attribute
body: <p>I have a project where I am trying download some data in a tab separated value format from a datahandler however, Google Chrome is sending a null value for the Origin header value.</p>
  
  <p>I'm seeing this when I navigate to <a href="http://server.corp.somebiz.com/reportpages/Report_Page_Requests_Over_Time.aspx?app=76ac42b7-ba6f-4be4-b297-758ebc9fe615" rel="nofollow noreferrer">http://server.corp.somebiz.com/reportpages/Report_Page_Requests_Over_Time.aspx?app=76ac42b7-ba6f-4be4-b297-758ebc9fe615</a></p>
  
  <pre><code>var url = 'http://server.corp.somebiz.com/DataHandlers/ReportSets.ashx?task=pagerequestsovertime&amp;app=188d1956-c4a7-42f7-9bdd-38f54c14e125&amp;format=tsv';
  
  d3.tsv(url, function(d) {
    d.date = parseTime(d.date);
    d.close = +d.close;
    return d;
  }, function(error, data) {
    if (error) throw error;
  
    console.log('Do stuff');
  });
  </code></pre>
  
  <p>Here are the raw headers on the request:</p>
  
  <pre><code>GET /DataHandlers/ReportSets.ashx?task=pagerequestsovertime&amp;app=786b5ef3-1389-4890-8004-533fd1f66f16&amp;format=tsv HTTP/1.1
  Host: server.corp.somebiz.com
  Connection: keep-alive
  accept: text/tab-separated-values,*/*
  Origin: null
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8
  </code></pre>
  
  <p>This ends with an error on the console:</p>
  
  <pre><code>XMLHttpRequest cannot load http://server.corp.somebiz.com/DataHandlers/ReportSets.ashx?task=pagere…6ac42b7-ba6f-4be4-b297-758ebc9fe615&amp;start=2/1/2017&amp;end=3/2/2017&amp;format=tsv. The 'Access-Control-Allow-Origin' header has a value 'http://server.corp.somebiz.com' that is not equal to the supplied origin. Origin 'null' is therefore not allowed access.
  </code></pre>
  
  <p>Not only am I looking for the why is this happening, what the conditions are that leads to Chrome sending a null Origin header to the server.</p>
  
  <p>This seems to be a Chrome specific issue as Internet Explorer 11 is sending the proper Origin value to the server.</p>
  
  <p>Update: To add another wrinkle, that may or may not be a contributing factor.</p>
  
  <p>I load the calling page in an <code>&lt;iframe&gt;</code> element to isolate scripted elements. Calling the page outside of the iframe causes a different behavior, the Origin header on Chrome is missing entirely.</p>