chore(cors): add whitelisted origin