Index: wp-includes/class-wp-customize.php
===================================================================
--- wp-includes/class-wp-customize.php	(revision 20785)
+++ wp-includes/class-wp-customize.php	(working copy)
@@ -71,18 +71,8 @@
 		if ( ! isset( $_REQUEST['customize'] ) || 'on' != $_REQUEST['customize'] )
 			return;
 
-		$url = parse_url( admin_url() );
-		$allowed_origins = array( 'http://' . $url[ 'host' ],  'https://' . $url[ 'host' ] );
-		// @todo preserve port?
-		if ( isset( $_SERVER[ 'HTTP_ORIGIN' ] ) && in_array( $_SERVER[ 'HTTP_ORIGIN' ], $allowed_origins ) ) {
-			$origin = $_SERVER[ 'HTTP_ORIGIN' ];
-		} else {
-			$origin = $url[ 'scheme' ] . '://' . $url[ 'host' ];
-		}
+		send_origin_headers();
 
-		@header( 'Access-Control-Allow-Origin: ' .  $origin );
-		@header( 'Access-Control-Allow-Credentials: true' );
-
 		$this->start_previewing_theme();
 		show_admin_bar( false );
 	}
Index: wp-includes/http.php
===================================================================
--- wp-includes/http.php	(revision 20785)
+++ wp-includes/http.php	(working copy)
@@ -222,3 +222,43 @@
 
 	return (bool) $objFetchSite->_get_first_available_transport( $capabilities );
 }
+
+function get_http_origin() {
+	$origin = '';
+	if ( ! empty ( $_SERVER[ 'HTTP_ORIGIN' ] ) )
+		$origin = $_SERVER[ 'HTTP_ORIGIN' ];
+
+	return apply_filters( 'http_origin', $origin );
+}
+
+function get_allowed_http_origins() {
+	$admin_origin = parse_url( admin_url() );
+	$home_origin = parse_url( home_url() );
+
+	// @todo preserve port?
+	$allowed_origins = array(
+						'http://' . $admin_origin[ 'host' ],
+						'https://' . $admin_origin[ 'host' ],
+						'http://' . $home_origin[ 'host' ],
+						'https://' . $home_origin[ 'host' ],
+						);
+
+	return apply_filters( 'allowed_http_origins' , $allowed_origins );
+}
+
+function get_allowed_http_origin() {
+	$origin = get_http_origin();
+
+	if ( $origin && ! in_array( $origin, get_allowed_http_origins() ) )
+		$origin = '';
+
+	return apply_filters( 'allowed_http_origin', $origin );
+}
+
+function send_origin_headers() {
+	if ( ! $origin = get_allowed_http_origin() )
+		return;
+
+	@header( 'Access-Control-Allow-Origin: ' .  $origin );
+	@header( 'Access-Control-Allow-Credentials: true' );
+}
\ No newline at end of file