CORS and access controls

[johakoch]

CORS is now handled before the access controls, so that preflight requests do not reach the access control. Non-preflight requests are passed to the access controls if the origin is allowed.

---

Reviewer checklist

• Read PR description: a summary about the changes is required
• Changelog updated
• Documentation: docs/{Reference, Cli, ...}, Docker and cli help/usage
• Pulled branch, manually tested
• Verified requirements are met
• Reviewed the code
• Reviewed the related tests