allowedOrigin is a CSP frame-ancestors source list: one source or
several, space-separated, wildcards allowed. CORS headers are added only
when it is * or one exact origin, because Access-Control-Allow-Origin
takes nothing else; a list there is invalid, and a browser rejects it.
Parameters
allowedOrigin: string = "*"
Allowed origin or frame-ancestors source list (optional, defaults to "*")
Build CORS/CSP headers for iframe embedding
allowedOriginis a CSPframe-ancestorssource list: one source or several, space-separated, wildcards allowed. CORS headers are added only when it is*or one exact origin, becauseAccess-Control-Allow-Origintakes nothing else; a list there is invalid, and a browser rejects it.