An optional whitelist of allowed client origins, or null.
null
A connection from another origin is refused before it is upgraded, with a 403 Forbidden.
403 Forbidden
final List<String> allowedOrigins;