82591368 allow cors

Updated application controller to handle CORS requests. This is so that the Navigator team can make requests from their Angular app.
I believe I can go back to using protect_from_forgery with: :exception since ApplicationController is no longer handling the OPTIONS requests