Configurable origins

Allow the default origins to be configurable via a configuration option named `CORS_ORIGINS`