Review/Harden Default CORS Settings

[fernando-mc]

We've used the same default CORS configuration for a while. If we're going to release another major version soon with one of the features @mikejpeters is working on we might as well consider updating these too and seeing if they're appropriate.

I think right now we allow POST/PUT from other Amazon AWS static site domains which we might want to reconsider. It's potentially useful when you have some static sites that need to make CORS requests but might not be the best default now that we have such easy ways to configure CORS.

cc @Shereef

[mikejpeters]

Is there already an easy way to configure CORS? I had been looking at issue #88 and related (but outdated) PR #103 - and considering assigning myself, but only if it's still useful.

Re: the default settings and security, sounds like a good plan. Hopefully someone here has some expertise / interest in that; it's not really in my wheelhouse.

EDIT: Also worth noting related issues #105 and #113