Currently, the list of allowed origins is hardcoded. But this is impractical for users wishing to deploy they own backend on unknown urls.
Therefore, the list of allowed urls must be derived from the currently active configuration.
