Allow all origins for cors

Will allow devs to hit code/prod endpoints from localhost, e.g. can hit discussion on prod for the comment counts, so wont need to run the discussion app locally

Can't see a downside to this - doesn't impact security or potential DOS attacks