Dynamic origin for allow_credentials