Update settings.py with CORS whitelist