title: Flask-cors is not denying origins as configured
body: <p>I'm trying to use flask-cors(3.0.8) with flask-restplus(0.13.0), allowing some origins and denying the others, but the cors doesn't deny any cross origin request. </p>
  
  <p>My architecture is disposed in a way that use 3 files to initialize my app:</p>
  
  <p><strong>1. app/__init__py (declaring my blueprint)</strong></p>
  
  <pre><code>from flask_restplus import Api
  from flask import Blueprint
  ...
  
  BLUEPRINT = Blueprint("api", __name__)
  API = Api(BLUEPRINT)
  ...
  </code></pre>
  
  <p><strong>2. app/main/__init__.py (with my create_app function, with CORS)</strong></p>
  
  <pre><code>...
  
  def create_app()
    app = Flask(__name__)
  
    CORS(app, resources={r"/*": {"origins": r".*\.mydomain.com"}})
  ...
  </code></pre>
  
  <p><strong>3. manage.py (containing my main process)</strong></p>
  
  <pre><code>from app.main import create_app
  from app import BLUEPRINT
  ...
  
  APP = create_app(os.getenv("APP_ENV", "dev"))
  APP.register_blueprint(BLUEPRINT)
  APP.app_context().push()
  ...
  
  if __name__ == "__main__":
    APP.run(host="0.0.0.0", port=80)
  </code></pre>
  
  <p>This approach is working to initialize my app, but my API is allowing all request from all domains instead of allowing requests only from something.my-domain.com, as configured.</p>
  
  <p>Someone already had this problem?</p>