diff --git a/server.js b/server.js
index 26238384b..ca98795f2 100644
--- a/server.js
+++ b/server.js
@@ -214,7 +214,7 @@ app.get('/api/config', function(req, res){
             // FIXME don't send websocketURL if websocketPath is provided. deprecated.
             websocketURL:'ws' + ((useSecureWebsockets) ? 's' : '') + '://' + host + ':' +
                 websocketPort + '/cryptpad_websocket',
-            httpUnsafeOrigin: config.httpUnsafeOrigin,
+            httpUnsafeOrigin: config.httpUnsafeOrigin.replace(/^ /, ''),
             adminEmail: config.adminEmail,
             adminKeys: admins,
             inactiveTime: config.inactiveTime,
diff --git a/www/common/cryptget.js b/www/common/cryptget.js
index f99a28a6c..39c43f857 100644
--- a/www/common/cryptget.js
+++ b/www/common/cryptget.js
@@ -33,7 +33,7 @@ define([
         var secret = Hash.getSecrets('pad', hash, opt.password);
         if (!secret.keys) { secret.keys = secret.key; } // support old hashses
         var config = {
-            websocketURL: NetConfig.getWebsocketURL(),
+            websocketURL: NetConfig.getWebsocketURL(opt.origin),
             channel: secret.channel,
             validateKey: secret.keys.validateKey || undefined,
             crypto: Crypto.createEncryptor(secret.keys),
diff --git a/www/common/invitation.js b/www/common/invitation.js
index 882eadffe..d73d5dd53 100644
--- a/www/common/invitation.js
+++ b/www/common/invitation.js
@@ -43,7 +43,7 @@ var factory = function (Hash, Crypt, Nacl, Scrypt/*, Util, Cred, nThen */) {
             'base64'); // format, could be 'base64'
     };
 
-    Invite.getPreviewContent = function (seeds, cb) {
+    Invite.getPreviewContent = function (seeds, cryptgetOpts, cb) {
         setTimeout(function () {
             cb(void 0, {
                 author: {
@@ -67,7 +67,7 @@ var factory = function (Hash, Crypt, Nacl, Scrypt/*, Util, Cred, nThen */) {
                 console.error(e);
                 cb(e);
             }
-        });
+        }, cryptgetOpts);
 //        cb("NOT_IMPLEMENTED"); // XXX cryptget
     };
 
diff --git a/www/common/outer/network-config.js b/www/common/outer/network-config.js
index 09b34ae0e..e310fe48b 100644
--- a/www/common/outer/network-config.js
+++ b/www/common/outer/network-config.js
@@ -3,13 +3,18 @@ define([
 ], function (ApiConfig) {
     var Config = {};
 
-    Config.getWebsocketURL = function () {
+    Config.getWebsocketURL = function (origin) {
         if (!ApiConfig.websocketPath) { return ApiConfig.websocketURL; }
         var path = ApiConfig.websocketPath;
         if (/^ws{1,2}:\/\//.test(path)) { return path; }
 
-        var protocol = window.location.protocol.replace(/http/, 'ws');
-        var host = window.location.host;
+        var l = window.location;
+        if (origin && window && window.document) {
+            var l = document.createElement("a");
+            l.href = origin;
+        }
+        var protocol = l.protocol.replace(/http/, 'ws');
+        var host = l.host;
         var url = protocol + '//' + host + path;
 
         return url;
diff --git a/www/teams/inner.js b/www/teams/inner.js
index 91a839501..16ef22adb 100644
--- a/www/teams/inner.js
+++ b/www/teams/inner.js
@@ -1032,7 +1032,8 @@ define([
     };
 
     makeBlock('link', function (common, cb) {
-        var hash = common.getMetadataMgr().getPrivateData().teamInviteHash;
+        var privateData = common.getMetadataMgr().getPrivateData();
+        var hash = privateData.teamInviteHash;
         var hashData = Hash.parseTypeHash('invite', hash);
         var password = hashData.password;
         var seeds = InviteInner.deriveSeeds(hashData.key);
@@ -1083,7 +1084,9 @@ define([
         };
 
         nThen(function (waitFor) {
-            InviteInner.getPreviewContent(seeds, waitFor(function (err, json) {
+            InviteInner.getPreviewContent(seeds, {
+                origin: privateData.origin
+            }, waitFor(function (err, json) {
                 if (err) {
                     // XXX handle errors
                 }