set CORS response header to only the hosted app domain
Merge pull request #105 from pfraze/cors

set CORS response header to only the hosted app domain