Allow specifying an origin in the CORS environment variable