Fix #250 CORS allow-origin should not be set for domain not specified in xitrum.conf