feat: added CORS whitelist