CORS Policy Passed by Environment var

[devinmatte]

We currently set the CORS value with an annotation. That can't pull from a config.

Ideally we pass the origins in by environment variable, and set it for the whole application
https://spring.io/blog/2015/06/08/cors-support-in-spring-framework

We need to set it not through an annotation if we want to use an environment variable