use simple whitelist instead of regex whitelist for CORS