fix(api): use default permissive CORS configuration when unset

Turns out CORS defaults to strict if no headers are sent at all, so this permissive default makes more sense.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>