adding CORS configuration. this will allow  CORS requests to the API endpoints
and block direct requests to the stats API
making /api/users and /api/challenges public
moving challenge summary stats endpoint out of the /api/stats tree
change summary stats endpoint in client
nginx template improvement