Production CORS Configuration

[toadzky]

Staging is working with '*' as the allowed origin, but prod was not with a more restrictive configuration. We need to work through the configuration of the CORS filter to understand what configuration will trigger what behavior and configure the filter accordingly.