Maybe we could re-use the domainWhitelist for the CORS header? I think we can leave this as-is now, but it'd be good to file a follow-up issue on this