CORS whitelist is regexes now