Fix security issue in CORS regex

Regex should not allow for `http://adversary.com/mckinsey.com`.