adding permissions to a route breaks app

[NathanLuan]

this works:
cross_origins: ["docs.web10.app", "localhost", "docs.localhost", "nathanluan.github.io"],
this doesn't:
cross_origins: ["docs.web10.app", "localhost", "docs.localhost", "nathanluan.github.io/web10-notes"],

preferable to have it work both ways.