Configure CORS origins as runtime configuration
### Problem

#### Security Issues

- **IMPACT**: The attacker can build a malicious web page to communicate with API in DMZ.


### Solutions

- Limit `Access-Control-Allow-Origin` with trust host domains on run-time.


### Problem Solving

- Add run-time configuration for CORS `origin` setting.
- Dynamically sent `Access-Control-Allow-Origin` HTTP response header by translating `Origin` http request header.
  - Configure a list of cors origin with `origins` option.
  - The default value is `*` for convenience.

#### Example

```bash
CORS_ORIGINS=https://posquit0.com,https://staging.posquit0.com
```