Allow cross origin request from anything

[Ryan Summey]

For production use, it’s best not to allow all origins. Instead, create a white list of allowed domains, and check each request against the white list.