Allow subdomains in origin whitelist.