Improve CORS default configuration

[blackjid]

No description provided.

[rjherrera]

We should definitely address this ASAP. I'd like to suggest something like this:

config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins '*'
    resource '/public/*', headers: :any, methods: :get
    resource '/api/*',
      headers: :any,
      expose: ['X-Page', 'X-PageTotal'],
      methods: :any
  end
end

Maybe with an explicit or more restrictive list of allowed methods for the api routes, like [:get, :post, :put, :options], but the main idea is there.

What do you think @blackjid ?

[blackjid]

great, yes.. we should...
looks good... maybe we can bring in someone else to review in a PR