adding in cors support for avatar urls with filter on owning domains