fix(api): use default permissive CORS configuration when unset

Turns out CORS defaults to strict if no headers are sent at all, so this permissive default makes more sense.

app.go

@@ -23,7 +23,8 @@ func serve(sig chan os.Signal, db *leveldb.DB) error {
 			AllowHeaders: []string{"Origin", "Content-Type", "Accept"},
 		}))
 	} else {
-		log.Println("CORS disabled")
+		log.Println("CORS unset")
+		app.Use(cors.New(cors.ConfigDefault))
 	}
 
 	var captcha fiber.Handler