Add CORS header ('Access-Control-Allow-Origin') to public APIs

[Dar13]

This permits external websites to query WriteFreely instances for:

• Collections
• Public posts in collections
• Specific public posts.

Without these changes, websites attempting to use the public API to query collections (such as my site: moor3.xyz, source) will receive CORS errors. @cjeller1592 helped me in the past with a CORS proxy (discussion), but it's time to fix it at the source.

I consider this PR to be more like an RFC, I'm fully open to guidance/critique on how to make these changes acceptable.

---

• I have signed the CLA

[thebaer]

Thank you for taking this on! I agree we should fix this in the application, and these are probably the most important API endpoints to do this on.

One thing that jumps out at me: as it stands, the header will only be set on successful responses. If an error is returned in any of these funcs, it bubbles up to the Handler.All() middleware and the Access-Control-Allow-Origin header is never set.

So a better place for these additions might be in the Handler.All() method (or a modified version, or a new variation of it), somewhere before this line: https://github.com/writeas/writefreely/blob/5c94d23466dc3e7e1821b845d9d7db9294c48af4/handle.go#L541

[Dar13]

So a better place for these additions might be in the Handler.All() method (or a modified version, or a new variation of it), somewhere before this line

It seems AllReader is a suitable place only GET requests use it currently. Those endpoints are (as best as I can tell) also endpoints that don't require authentication if the instance is public. I've adjusted the patch in this PR accordingly.

For authenticated endpoints I think a more fully-fleshed out approach is needed, such as users choosing which origin(s) are permitted to query/update/post/etc among others.

[thebaer]

Sorry for the delay on this! I agree, the AllReader method is a good place for the header that should cover most basic needs.

Beyond that, we can definitely expand on this with better customization in the future. If you'd like to get that discussion started, please feel free to start a topic on the forum!

Merging now -- thanks again for contributing!