fix(protocol): opaque origin matching and validation (#758)