[nim] #X Extracts cors middleware out of server.js
[nim] #X Using better import statements
[nim] #X access-control-allow-origin header is set to the domain of the requester if it is among the allowed domains in the config. If requester has no domain, it sets the header to null. Negative test cases pending.