additional checks for cors

[chicco785]

allow_credentials - Indicate that cookies should be supported for cross-origin requests. Defaults to False. Also, allow_origins cannot be set to ['*'] for credentials to be allowed, origins must be specified.

https://fastapi.tiangolo.com/tutorial/cors/#use-corsmiddleware

Originally posted by @chicco785 in #50 (comment)

also, we have to understand impact on cors of the usage of envoy.