Updated CORS whitelist to include 2nd dev site