Changed ALLOWED_ORIGINS to ALLOWED_ORIGIN, since I can't figure out how to set the same header twice in Meteor.
Version bump