I'm unable to test right now, but I think if you set the variable using something like this:
<VirtualHost hostname:80>
...
SetEnv CORS_HOSTS desired.domain.name
...
</VirtualHost>
The PHP code should read the value (line 56) and insert it into $AUTHORIZED_HOSTNAMES
variable (line 58):
NOTE:
You need to restart apache2
after edit your config.