Cleaned up the allowed origins list, added preview.engine.co and ...

apps.engine.co.