custom_origins = custom_origins or app.config.get('ALLOWED_ORIGINS', [])