load crossOriginWhitelist from window.ENV, close #218