closes #41. CORS whitelist can be an *