Allow XSS requests from a domain configured in the SAME_ORIGIN env var