Allow only whitelist domains for cors