Update config.md

Specify how to list allowed origins

docs/hub/config.md

@@ -25,7 +25,7 @@ When using environment variables, list must be space separated. As flags paramet
 | `cert_file`                | a cert file (to use a custom certificate)                                                                                                                                                                                                                                                                                                                                                |                                                          |
 | `key_file`                 | a key file (to use a custom certificate)                                                                                                                                                                                                                                                                                                                                                 |                                                          |
 | `compress`                 | Use HTTP compression                                                                                                                                                                                                                                                                                                                                                      | `false`                                                  |
-| `cors_allowed_origins`     | a list of allowed CORS origins, can be `*` for all                                                                                                                                                                                                                                                                                                                                       |                                                          |
+| `cors_allowed_origins`     | a space-separated list of allowed CORS origins, can be `*` for all                                                                                                                                                                                                                                                                                                                                       |                                                          |
 | `debug`                    | debug mode, **dangerous, don't enable in production** (logs updates' content, why an update is not send to a specific subscriber and recovery stack traces)                                                                                                                                                                                                                              | `false`                                                  |
 | `demo`                     | demo mode (automatically enabled when `debug` is `true`)                                                                                                                                                                                                                                                                                                                                 | `false`                                                  |
 | `dispatch_timeout`         | maximum duration of the dispatch of a single update, set to `0s` to disable                                                                                                                                                                                                                                                                                                              | `5s`                                                     |