figure out how to do CORS clearance in django for "magically handled" URLs

[Pomax]

specific problem: make CORS work with OPTIONS preflights for /api/clubs calls on localhost. There is some deep magic going on, and the "allowed origins" header is not doing what it should be, even though it looks like it is.

[Pomax]

We had to change the CORS setting:

# Turn off blanket CORS ('*') in favour of whitelisting.
CORS_ORIGIN_ALLOW_ALL = False

# Only process CORS on the following paths requested by clients.
CORS_URLS_REGEX = r'^(/api/).*$'

# When CORS kicks in, only allow origins matching the sites in the whitelist:
CORS_ORIGIN_WHITELIST = os.environ.get('CORS_ORIGIN_WHITELIST', 'localhost:8008').split(',')

# Allow credentials for CORS-controlled routes.
CORS_ALLOW_CREDENTIALS = True

This introduces a new env var CORS_ORIGIN_WHITELIST, a comma-separated list of sites that are allowed to interface with the teach api.

(see https://github.com/ottoyiu/django-cors-headers)