BUGFIX: CORS origins had to be comma separated