Make CORS headers configurable

[jonathan-wiens]

As a software developer I want to deploy feature app branches. Currently, the CORS configuration is hard coded and requires a hard deploy for new frontend URLs to be added to the CORS list.

Please make the configuration of CORS URLs configurable, e.g. via an environment variable that can be set in Heroku like this:

ACCEPTED_ORIGINS=["url1","url2"]

Then the instance only needs to be restarted and we don't need to create commits / deploys