API: Two 'access-control-allow-origin's collide

[PesiTheWizard]

Most API responses have two different access-control-allow-origin headers, meaning browsers will refuse to make use of fetched data as the header is impossible to match.

One is access-control-allow-origin: *.
Three lines later we get access-control-allow-origin: playstrategy.org.

Comparing this to lichess itself and its other sister sites suggests the second one is added in error.

[JamesHeppell]

Thanks for the comment, we have this bug logged against an issue. Unfortunately its low priority atm but hopefully we will address it in the coming months.