and come back to set CORS_ORIGIN_WHITELIST in the next chapter.