$allowedIn = array("http://this.site.org", "https://this.site.org", "http://that.site.org", "https://that.site.org");
if(in_array($_SERVER['HTTP_ORIGIN'], $allowedIn)){
    $CORS = $allowedIn[array_search($_SERVER['HTTP_ORIGIN'], $allowedIn)];
    header("Access-Control-Allow-Origin: " . $CORS);
}