A list of origins that should be allowed to make cross-origin calls.
Are credentials allows in CORS requests?.