Add support for multiple allowed origins

The `cors.allowOrigin` parameter can now accept a space separated list of domains.  I also updated the `cors` function to be a pimple protected function instead of returning a function.