enable a list of urls

We can pass an array of URLs to :origin_whitelist, so I am simply taking
the environment variable, splitting it, and giving it to the setter. I
probably should check to make sure it's an array... but I'm pretty sure
that split will handle that automatically. If there's only one item,
String#split will of course handle it.

This closes #2.

Reference:
- https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/http_origin.rb#L27