Revert "Set CORS headers on api controller actions"

This reverts commit 5c56f2bf20c4841216062dc6355a0958dd8069a8.