Fix CORS for st2auth

STORM-862