adding S3 domains to CORS whitelist