Pull CORS origin into configuration.

- Set up Figaro for ENV-based application configuration.
Disable protect_from_forgery until proper authentication is implemented.