Panic serving XXX runtime error: invalid memory address or nil pointer dereference

Hi from my understanding I must set a field like:

Access-Control-Allow-Origin https://corona.translatum.xyz/ https://dev.kraken.translatum.xyz/ https://cov19.kraken.translatum.xyz/

How can I achieve that this is only active for the upload.translatum.xyz url?

How can i achieve that it is for all urls? It seems I somehow set the header the wrong way…an example in the documentation would be really helpful.