#71 - restrict origin requests from app.config