Add configurable cross-origin restriction