www: Set a sensible default for the allowed_origins

Allowing ourself shouldn't be a security issue, and is needed for the Forced builds (for instance).