Add cross domain request whitelist