Add configurable allowed CORS origins

[LowBudgetMan]

Currently the only allowed origin is a hard-coded http://localhost:3000 for local development. We will need to make that configurable based on properties to support the UI being run on a different domain from the API.