HOTFIX: reflect origin headers to allow auth

I broke remote authentication in e70230a. An upgrade to rack-cors changed the behavior of `origins '*'`
such that it now does not reflect the request's origin and instead actually sends '*' for the allowed origins header. That means authentication on our requests fails :(

See this change in rack-cors: cyu/rack-cors#142

We needed this behavior initially because it seemed like `Authorization` headers in our requests were getting stripped, but it seems like this may no longer be true. That needs more testing, though. For now, force rack-cors to return to its earlier behavior.

 Please enter the commit message for your changes. Lines starting

config/application.rb

@@ -24,7 +24,7 @@ class Application < Rails::Application
       end
 
       allow do
-        origins '*'
+        origins /.*/
         resource '*', :headers => :any, :methods => [:get, :post, :options], :if => is_admin_url
       end
     end