remove whitelist

`allowed_origins` reads nicer.