func clientOriginCheck(ctx context.Context, cond, args string) error {
	req := requestFromContext(ctx)
	if req == nil {
		return errgo.Newf("no origin found in context")
	}
	if reqOrigin := req.Header.Get("Origin"); reqOrigin != "" && reqOrigin != args {
		return errgo.Newf("request has invalid Origin header; got %q", reqOrigin)
	}
	return nil
}
clientOriginCheck implements the Origin header checker
for an HTTP request.
package httpbakery
import (
	"net"
	"net/http"
	"golang.org/x/net/context"
	"gopkg.in/errgo.v1"
	"gopkg.in/macaroon-bakery.v2/bakery/checkers"
)
type httpRequestKey struct{}
func ContextWithRequest(ctx context.Context, req *http.Request) context.Context {
	return context.WithValue(ctx, httpRequestKey{}, req)
}
func requestFromContext(ctx context.Context) *http.Request {
	req, _ := ctx.Value(httpRequestKey{}).(*http.Request)
	return req
}
const (
	CondClientIPAddr = "client-ip-addr"
	CondClientOrigin = "origin"
)
const CheckersNamespace = "http"
var allCheckers = map[string]checkers.Func{
	CondClientIPAddr: ipAddrCheck,
	CondClientOrigin: clientOriginCheck,
}
func RegisterCheckers(c *checkers.Checker) {
	c.Namespace().Register(CheckersNamespace, "http")
	for cond, check := range allCheckers {
		c.Register(cond, CheckersNamespace, check)
	}
}
func NewChecker() *checkers.Checker {
	c := checkers.New(nil)
	RegisterCheckers(c)
	return c
}
func ipAddrCheck(ctx context.Context, cond, args string) error {
	req := requestFromContext(ctx)
	if req == nil {
		return errgo.Newf("no IP address found in context")
	}
	ip := net.ParseIP(args)
	if ip == nil {
		return errgo.Newf("cannot parse IP address in caveat")
	}
	if req.RemoteAddr == "" {
		return errgo.Newf("client has no remote address")
	}
	reqIP, err := requestIPAddr(req)
	if err != nil {
		return errgo.Mask(err)
	}
	if !reqIP.Equal(ip) {
		return errgo.Newf("client IP address mismatch, got %s", reqIP)
	}
	return nil
}