Add CORS headers so QA API can be used from JavaScript from another origin

[zimeon]

The key requirements are:

1. to add the following HTTP header to responses to GET, where * indicates that code from any origin should be able to read data from QA.:

Access-Control-Allow-Origin: *

2. to support the OPTIONS HTTP method on the same resource, for which I think can be just the addition of the HTTP methods supported, perhaps a 204 with headers:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, OPTIONS

See http://www.w3.org/TR/cors/ for gory details, https://fetch.spec.whatwg.org/#cors-protocol for more a intelligible descriptions.

Examples in Ruby in RIIF -- add ACAO and adding support for OPTIONS (which in this case allows the Authorization header, not needed for QA I assume).

[elrayle]

CORS headers and OPTIONS HTTP method support were added to QA in PR samvera/questioning_authority#172. At this writing, the PR is pending review and merge. It was added as a configurable option, so I do not expect any objects to it merging.

[elrayle]

The CORS headers have been added to the min_context branch of QA.

Remaining Work:

• setup on elr dev server to allow testing
• test in an actual browser accessing cross-origin

[elrayle]

This work is essentially done. It is configured to be enabled in cul-it/qa_server. It will be available in production when the production system comes back on line.