Attempting to add CORS support

[shaworth]

This is my failed attempt to insert the Access-Control-Allow-Origin and Access-Control-Allow-Headers to satisfy preflight ORIGIN requests.

[strugee]

@shaworth so the basic problem is that you're adding your code in the wrong order - under Express the order that you add things in matters a great deal.

I suspect that you thought you were adding this code only to the /api route, but that's not actually true. The addRoutes function that routes/api.js exports is run by lib/app.js and is passed the global Express application as app. Then it adds stuff that it needs. Hence, when you did app.use in api.js you weren't scoping it to /api; instead, you were doing app.use for the global application, just very late during startup. I know this is super confusing - when #1232 lands it should become much clearer. Not sure when that'll land though since we still have some technical debt to pay off before that becomes possible.

In any case, the solution to your problem is to move the code you wrote to lib/app.js - a good place to put it might be around line 332, right after app.use(versionStamp);. If you want to scope it only to the /api route, you can make the function the second argument and make the first argument "/api". See the Express docs for details.

Ping me when you have time to clean this up for merge and I'll do a full review. Good luck!