www: Set a sensible default for the allowed_origins

Allowing ourself shouldn't be a security issue, and is needed for the Forced builds (for instance).
Merge pull request #1276 from benallard/patch-1

www: Set a sensible default for the allowed_origins