XD-1251 Allow config of Access-Control-Allow-Origin

Use can set the value xd.ui.allow_origin to override the
default (http://localhost:9889).