Make it easier to config allowed origins for /auth