Enable CORS for api controllers

Turned out that enabling CORS for SignalR did not also enable CORS for
the api controllers.  Added back the ASP.NET CORS line to class Startup,
and now it works again.