convert allow_cors to string option; if included can be * or comma-sep list of host URLs
convert allow_cors to string option; if included can be * or comma-sep
list of host URLs

pombredanne/cubes,noyeitan/cubes,she11c0de/cubes,zejn/cubes,jell0720/cubes,she11c0de/cubes,cesarmarinhorj/cubes,jell0720/cubes,ubreddy/cubes,pombredanne/cubes,pombredanne/cubes,zejn/cubes,ubreddy/cubes,jell0720/cubes,zejn/cubes,she11c0de/cubes,noyeitan/cubes,noyeitan/cubes,ubreddy/cubes,cesarmarinhorj/cubes,cesarmarinhorj/cubes