fix(api): use default permissive CORS configuration when unset

Ophestrarequested to merge
cors-unset into main

Turns out CORS defaults to strict if no headers are sent at all, so this permissive default makes more sense.

Merge request reports