news flash api

[atalyaalon]

In this pr I added /* to news-flash api cors func
I think that the origins should be cors_site_list (like r"/user/*" in the same func)

@tkalir what do you think?

Note - unrelated but FYI - I also had to add this pr so it will all work: https://github.com/data-for-change/anyway/pull/2633/files

[tkalir]

I believe it's supposed to work either way, but if that works no reason to change it. glad you found a better solution than my after_request function, anyway.