Limiting API to allow CORS requests to a whitelisted set of origins