Update to restrict cors to whitelist