URL(s) combined under a domain. Incoming requests that are not coming from any of the specified domains will provoke a CORS error.
Valid formats: www.example.com / subdomain.firstleveldomain.org / trustedapp.azurewebsites.net
Wildcards like www.*.luware.com are not allowed.