adds allowOrigins setting

@tomsteele can you please review :)