user CORS whitelisting
Merge branch 'master' of ssh://github.com/deian/nsdi2014