allow origin as variable