XD-1251 Allow config of Access-Control-Allow-Origin

Use can set the value xd.ui.allow_origin to override the default
(http://localhost:9889).