add production domains to CORS whitelist