All CORS requests include the `Origin` header which indicates
the source domain name. Create a server-side list of trusted
domains which can consume the CORS resources and when a request is
received set the `Access-Control-Allow-Origin` response header
to the right value from the list matching the `Origin` request header.