Fix CORS development environment issue

[leela-solomon]

@amnak613 identified that we need to account for browser same-origin policy when making client-side API calls (http://localhost:3000 to http://localhost:8000) while working on her branch. This issue is a barrier to testing client-side API calls locally.

The issue is due to not having the origins not being the same and is often solved with a CORS header that gives permission to http://localhost:3000.

Note

NOTE: the plan is for preview and production deployments to use the same origin (host and port), so this issue doesn't currently apply in that scenario. It only currently applies in the dev environment scenario. However, it's possible that the aforementioned deployments could use different origins in the future.

EDIT: Added some technical info for reference in comments: #175 (comment)

[nickvisut]

Adding some technical info that's been gathered for reference:

There are several known methods for addressing the issue (including the CORS header mentioned above), three of which are listed below:

1. add a CORS header to the API that checks if the HTTP origin is in the list of allowed origins (in our case, development environment origins like http://localhost:3000); for FastAPI, see their docs for implementation details
2. have dev temporarily run browser without CORS enabled (see https://www.junian.net/dev/safari-disable-cors/, https://stackoverflow.com/questions/4556429/disabling-same-origin-policy-in-safari)
3. proxy app and/or API so that the origins are the same

There are various pros and cons to diff approaches discussed in this Slack thread.

[nickvisut]

This is partially fixed by #184, but there's some configuration that appears to be missing (from eg, ucicorn.