Make it more obvious that admins have to set the corsOrigin

[chrismwendt]

This would have prevented sourcegraph/browser-extensions#237 and similar issues.

[ijsnow]

Simply warning if corsOrigin is not set would require making a graphql handler that checks this and returns that or changing CORS errors on the graphql endpoint to not be 401.

I'd like to propose a new flow that prompts the user to go set the corsOrigin when they first set the sourcegraph url IF they are an admin. We'd show the prompt in place of the green success message after they enter a URL and its connected.

It could say "Is this your first times setting up? Make sure to set your corsOrigin is set to contain your code host."

Then we keep that message there until they click a button that says "I have set the corsOrigin".

[lguychard]

#1954 allows to successfully bypass corsOrigin restrictions on Chrome and FF.

[sqs]

@lguychard Can we completely remove corsOrigin now or is it still needed?

[lguychard]

I think it may still be needed if the code host is Phabricator (since in that case, all requests will be made from the in-page script, and not the browser extension). @ijsnow can you confirm?