add headers and restirct domains

api/main.py

@@ -54,10 +54,12 @@ print("db loaded")
 mode = 'run'
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    #allow_origins=["*"],
+    allow_origins=["https://show.choozmo.com","https://video.choozmo.com"]
     allow_credentials=True,
     allow_methods=["*"],
-    allow_headers=["*"],
+    #allow_headers=["*"],
+    allow_headers['Accept','Origin','Content-Type','X-LS-CORS-Template','X-LS-Auth-Token','X-LS-Auth-User-Token','Content-Type','X-LS-Sync-Result','X-LS-Sequence','token'],
   #  allow_headers=['Accept','Content-Type','X-Requested-With','x-api-key'],
 )
 SECRET_KEY = "df2f77bd544240801a048bd4293afd8eeb7fff3cb7050e42c791db4b83ebadcd"