configure Access-Control-Allow-Origin with DOMAIN_APP_URL