Fix cors for production (security)

fix cors and re-added `postinstall` to package.json

package.json

@@ -11,6 +11,7 @@
     "dev": "SET NODE_ENV=development&& npm run start-dev",
     "prod": "SET NODE_ENV=production&& SET PORT=8080&& SET WSPORT=8000&& npm start",
     "build": "rimraf ./static/assets && webpack -p --progress --stats --config ./webpack/prod.config.js",
+    "postinstall": "npm run build",
     "eslint": "eslint .",
     "jscs": "jscs .",
     "coveralls": "copy coverage/lcovonly/lcov.info | node ./node_modules/coveralls/bin/coveralls"

src/server.js

@@ -45,8 +45,17 @@ export default function( callback ) {
   // Create the Walmart Labs Hapi Server
   const server = new Hapi.Server(); // No debug no production
   // Configure connections
-  server.connection({ host: SERVER_HOST, port: SERVER_PORT, labels: [ 'api' ], routes: { cors: true }});
-  server.connection({ host: SERVER_HOST, port: WS_PORT, labels: [ 'ws' ], routes: { cors: true }});
+  server.connection({
+    host: SERVER_HOST,
+    port: SERVER_PORT,
+    labels: [ 'api' ],
+    routes: {
+      cors: {
+        origin: [ 'http://' + SERVER_HOST + ':' + WS_PORT ]
+      }
+    }
+  });
+  server.connection({ host: SERVER_HOST, port: WS_PORT, labels: [ 'ws' ] });
 
   // Set names for each connection
   server.connections[0].name = 'API';