Origins

Published allowedOrigins apply CORS for the widget. They identify the workspace. They do not prove the end user may read or write. Set localhost and production origins in update_rfq_draft before publish.