added CORS origins whitelist