No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

[IAmGav (Gavin Perch)]

cors origins setting is controlled in admin > settings > security

you only need DISCOURSE_ENABLE_CORS: in your app.yml