A list of origins that are allowed to make cross-origin calls.
Are credentials allowed in CORS requests?