Adjusting CORS to use whitelist