CORS config

`http.origins` as a list of regexes to send back CORS headers to matched origins.