Only allow whitelist of origins for CORS