Fix domain checking for request (#40080)

Author: Fedik

build/media_source/system/js/core.es6.js

@@ -623,8 +623,12 @@ window.Joomla.Modal = window.Joomla.Modal || {
         const token = Joomla.getOptions('csrf.token', '');
 
         // Use the CSRF only on the site's domain
-        // eslint-disable-next-line no-restricted-globals
-        if (token && (newOptions.url.startsWith('/') || newOptions.url.startsWith(location.origin))) {
+        if (
+          token && (
+            (!newOptions.url.startsWith('http:') && !newOptions.url.startsWith('https:'))
+            || newOptions.url.startsWith(window.location.origin)
+          )
+        ) {
           xhr.setRequestHeader('X-CSRF-Token', token);
         }