allow static method
Sends credentials to origin -- https://api.example.com -- from now
on.
Throws ArgumentError for anything that is not one exact origin: a
wildcard, null, a path or trailing slash, a query, user information,
or plain http anywhere but the loopback, where a network attacker who
can rewrite the page can also spend the session.
Implementation
static void allow(String origin) {
_origins.add(_normalise(origin));
}