--- a/dom/apps/ImportExport.jsm
+++ b/dom/apps/ImportExport.jsm
@@ -384,45 +384,48 @@ this.ImportExport = {
       meta.downloadSize = 0;
       meta.lastUpdateCheck = Date.now();
       meta.updateTime = Date.now();
       meta.manifestHash = AppsUtils.computeHash(manifestString);
       meta.installerAppId = Ci.nsIScriptSecurityManager.NO_APP_ID;
       meta.installerIsBrowser = false;
       meta.role = manifest.role;
 
+      let devMode = false;
+      try {
+        devMode = Services.prefs.getBoolPref("dom.apps.developer_mode");
+      } catch(e) {}
+
       // Set the appropriate metadata for hosted and packaged apps.
       if (isPackage) {
         meta.origin = "app://" + meta.id;
         // Signature check
         // TODO: stop accessing internal methods of other objects.
         let [reader, isSigned] =
           yield DOMApplicationRegistry._openPackage(appFile, meta, false);
         let maxStatus = isSigned ? Ci.nsIPrincipal.APP_STATUS_PRIVILEGED
                                  : Ci.nsIPrincipal.APP_STATUS_INSTALLED;
-        try {
-          // Anything is possible in developer mode.
-          if (Services.prefs.getBoolPref("dom.apps.developer_mode")) {
-            maxStatus = Ci.nsIPrincipal.APP_STATUS_CERTIFIED;
-          }
-        } catch(e) {};
+        // Anything is possible in developer mode.
+        if (devMode) {
+          maxStatus = Ci.nsIPrincipal.APP_STATUS_CERTIFIED;
+        }
         meta.appStatus = AppsUtils.getAppManifestStatus(manifest);
         debug("Signed app? " + isSigned);
         if (meta.appStatus > maxStatus) {
           throw "InvalidPrivilegeLevel";
         }
 
         // Custom origin.
         // We unfortunately can't reuse _checkOrigin here.
-        if (isSigned &&
-            meta.appStatus == Ci.nsIPrincipal.APP_STATUS_PRIVILEGED &&
+        if ((isSigned || devMode) &&
+            meta.appStatus >= Ci.nsIPrincipal.APP_STATUS_PRIVILEGED &&
             manifest.origin) {
           let uri;
           try {
-            uri = Services.io.newURI(aManifest.origin, null, null);
+            uri = Services.io.newURI(manifest.origin, null, null);
           } catch(e) {
             throw "InvalidOrigin";
           }
           if (uri.scheme != "app") {
             throw "InvalidOrigin";
           }
           meta.id = uri.prePath.substring(6); // "app://".length
           if (meta.id in DOMApplicationRegistry.webapps) {