Cleaned up the allowed origins list, added preview.engine.co and apps.engine.co.
Merge pull request #18 from curtislacy/Fix-Origin-List

Cleaned up the allowed origins list, added preview.engine.co and ...