Expose HOSTED_VIEWER_ORIGINS as an option.

[burtonator]

Right now you restrict URLs to HOSTED_VIEWER_ORIGINS but there's now easy way to change these as it's a const.

[Snuffleupagus]

Please refer to #6916 for some background on this functionality.

Making this easily configurable could, as far as I can tell, basically make it possible to modify the HOSTED_VIEWER_ORIGINS list at runtime. Hence that would essentially render the security that this functionality provides useless, since a user could then (easily) modify it to bypass the restrictions set.

[timvandermeij]

Closing since it does not look like there is anything we can do here that won't impact the functionality.

[mustafa0x]

@Snuffleupagus Isn't that a job best left for CORS?