I think it make sense to make those a regexp, re are fast enough imo, so that one can configure say, "*.intranet.com"
cross origin is only used if origin is different, so this is really not the critical path.