If the request doesn't come from a domain that we white list, we shouldn't set any CORS headers at all