limit proxy hosts and origin; support for preflight requests