Allow configurable CORS

Was testing this with the UI and API running on different hosts (ports) and added CORS support instead of running a proxy in front of both.