Allow-Cross-Origin Domain to access /verify

the default should be empty

`export ALLOWED_CORS_DOMAINS=""`