Adds AllowedOrigins option to allow CORS csrf token generation