commands/http: Allow API requests from whitelisted origins
daemon: Set allowed API origins in API_ORIGIN environment variable