Is it better to change `corsAllowed` to a hashmap, then do a look up rather than go through?
Also, when add corsAllowed origin to the hashmap, we could do some validation checking.