use re.match instead of == to check CORS whitelist domans