accept a filter function for AllowCORS, supporting sharing to multiple origins