Make Access-Control configurable instead of hardcoded

[albe]

Currently, the Acces-Control-Allow header is hardcoded to a * return value, i.e. the API can be called from any website. While this is a sane default, it might not be wanted in every case. The header value sent should be configurable via setting (assuming a global value for all controllers).

[rr-appadaptive]

I think that even if no other services have to be handled in an application-stack, the Access-Control-Allow headers should be handled by a reverse-proxy (We us traefik - https://traefik.io - ) for that.