Added allowed origin 'whitelist' functionality to CorsFeature

Added optional constructor parameter that allows an origin whitelist to be specified. The feature then also adds a request filter that echos back the requested origin if it appears in the whitelist