Externalizing the CORS Whitelist Setting