Corrected CORS whitelist domains