Allow CORS requests in production from WEB_CLIENT_HOST.