bugfix, cors enhancement

CORS now support multiple domains list (as comma separated string)