added more allowed hosts to CORS filter.