restrict CORS to /api/ routes
#1585

jseppi wants to merge 1583-restrict-cors into develop

We do not currently have an analysis of these two commits