Make allowed CORS domains configurable via CORS_WHITELIST setting. Can be a string or a yaml string list