Response->setAllowedCrossDomainUrls()