Allow authless cross-origin requests from trusted domains