Allow an array of acceptable origins to be set for CORS header
Fix using array of CORS domains