set CORS response header to only the hosted app domain

https://github.com/pfraze/phoenix/issues/103