Whitelist all domain to support CORS