How to configure the CORS module for multiple domains?
Upon further investigation, this seems to be an issue with the CORS module, and has been patched, so hopefully fixed in future versions.

https://www.drupal.org/node/2780297