Security: Fix overly permissive CORS

[adityack477]

The Express server uses cors('*') which allows any origin to call the API, including credentials. This is a security risk. The CORS config should be updated to accept only the frontend origin from an env variable.