Allow CORS from xip.io and CloudFront host