Adds whitelist domains to CORS headers