More secure, extensible implementation of CORS headers

Core common needs a class that will take a list of domains allowed to access the backend from a browser. The previous implementation still exists in this PR but is marked as deprecated.