CORS concerns addressed with whitelist