able to support list in XS_SHARING_ALLOWED_ORIGINS