Any domain pointing at the server now redirects to ORIGIN with a 301, so
a
site is reachable at exactly one origin. Only GET and HEAD are
redirected;
mutating requests are left alone, since no UI is served from another
domain
and redirecting across origins would strip the Origin header and fail
CSRF
anyway. Requests addressing the server itself (localhost, 127.0.0.1,
::1) are
exempt so health checks and internal calls keep working, and the
redirect is
off in dev and in no-backend mode.

Not a CSRF measure — the request origin is derived per request from the
forwarded headers, so another domain would authenticate fine on its own.
It
matters because the admin session cookie is host-only, so each domain
would
otherwise carry a separate login, and canonical links and preview images
are
built from ORIGIN.