added cross origin whitelisting to application controller