allow for a dynamic list of allowable origin hosts

this allows for both dev.localhost and demo.localhost to share a backend.