CORS "same origin" check is incorrect (ports + subdomains)

[rexxars]

Describe the bug
Determining if a request is cross-origin is currently implemented by checking the hostname of the current page and the remote URL. This is not in accordance with the specification, where the origin is considered to be scheme + domain + port. In addition, the check currently allows subdomains - which is also not in accordance with it.

To Reproduce
Steps to reproduce the behavior:

1. Do a request from http://localhost:1234 to http://localhost:9876
2. Request should have triggered cross-origin behavior (port differs), but currently does not
3. Do a request from http://some.host to http://sub.some.host
4. Request should have triggered cross-origin behavior (hostname differs), but currently does not

Expected behavior
Should follow browser behavior for cross-origin requests