feature: add multiple allowOrigins

The server now compares the request URI with the list, and sends the
correct `Access-Control-Allow-Origin` back.