add cross origin whitelist