Add `ApplicationConfig.Origins`.

The `Origins` option specifies a list of allowed WebSocket origins. If empty
or omitted, all origins will be allowed.