Add allowed origin in CORS