feat(api): allow configurable CORS policy

[walldiss]

Implementation ideas

We need to allow users to configure CORS policy. It should accomodate both secure and easy to configure way to set up CORS for different usecases.

• if skip-auth is enabled CORS should allow any origin
• default CORS setting should be strict mode(no cors headers)
• have a config field to add more to Access-Control-Allow-Origin manually