extracted AllowOrigin header into config file