You cannot do that.

Origin is mentioned to enforce CORS. You will need to out in all the origins (as a comma or colon separated string) and only then it can work.

Dynamic addition defeats the very idea of CORS protection.