The CheckOrigin function only accepted the production domain, rejecting
localhost connections in dev. Also removed redundant error response after
a failed upgrade since the upgrader already writes its own HTTP response.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
