A list of origins that should be allowed to make cross-origin calls.
Whether CORS requests with credentials are allowed.