CORS Origin for HTTP API and Metrics API

We need to finish threading through the correct CORS policies for the HTTP APIs. 

This involves adding a CLI flag and then putting the CORS middleware onto the routers for both the http api and the metrics API. 

There is a stub in the metrics api already, but its currently set to allow all. 