use fnmatch for CORS origins, per tardyp's suggestion
remove TODO comment that's BEENDONE