We need more CORS configurability

[atruskie]

As the workbenches can be public APIs, we need random website to be able to access different API end points from a range of websites that we can't predetermine.

Our current CORS configurability is not good enough:

baw-server/config/initializers/cors.rb

Line 8 in 40eb800

origins Settings.host.cors_origins

. We can only allow whole origins.

So the plan is:

• Change CORS responses so that media GET requests allow cross origin
• Keep the CORS of /security routes restricted to the workbench client
• Maybe: Change to http only auth cookeis and set Access-Control-Allow-Credentials

Basically, allow access for any public non-mutative routes/actions, but restrict security routes and any mutative actions for trusted origins.