Document the two origin/host settings in .env.example

The CORS example was schemeless (source1.domain.com:p1), which is not an
origin and so never matches anything -- anyone following it got silent
non-functionality. Adds SPOOLMAN_ALLOWED_HOSTS alongside it and points at
the new wiki Security page.

.env.example

@@ -84,10 +84,26 @@ SPOOLMAN_PORT=7912
 #PUID=1000
 #PGID=1000
 
-# Allows CORS ORIGIN. 
-# Use the https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin semantics
-# separated by commas
-# for example to allow request from source1.domain.com on port p1 and source2.domain.com on port p2
-# SPOOLMAN_CORS_ORIGIN=source1.domain.com:p1, source2.domain.com:p2
-# to allow from any
-# SPOOLMAN_CORS_ORIGIN=*
+# Extra browser origins allowed to talk to Spoolman, separated by commas.
+# Only needed for a web UI served from a different address than Spoolman, such as a Fluidd or
+# Mainsail instance on another host. Spoolman's own web UI does not need it, and neither does
+# Moonraker, OctoPrint, Home Assistant or anything else that is not a browser.
+# Each entry must include the scheme -- a bare "host:port" is not an origin and will never match.
+# See https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin
+#SPOOLMAN_CORS_ORIGIN=https://fluidd.local,http://mainsail.local:8080
+# To allow every origin. WARNING: this turns the origin checks off entirely, so any website you
+# visit can read and modify your Spoolman data in the background. Only on a trusted network.
+#SPOOLMAN_CORS_ORIGIN=*
+
+# Hostnames this Spoolman answers to, separated by commas. Off unless set.
+# Protects against DNS rebinding, where a domain an attacker owns is pointed at your Spoolman's
+# local address so that their web page can talk to it. Hostnames, not origins: no scheme, no port.
+# "*.mydomain.com" covers the domain and its subdomains.
+# IP addresses, single-word names, .local/.lan/.home/.home.arpa/.internal names and any hostname
+# already in SPOOLMAN_CORS_ORIGIN keep working without being listed.
+# If you reach Spoolman through a reverse proxy on a real domain, that domain must be listed here
+# once this is set, or every request is refused with a 400.
+#SPOOLMAN_ALLOWED_HOSTS=spoolman.mydomain.com
+
+# See the Security page in the wiki for how these two fit together:
+# https://github.com/Donkie/Spoolman/wiki/Security