Update CORS to allow POST to GraphQL

- also narrows scope for GET requests to `/api/v1/*` instead of `*`

Author: JPrevost

config/application.rb

@@ -27,7 +27,8 @@ class Application < Rails::Application
     config.middleware.insert_before 0, Rack::Cors do
       allow do
         origins '*'
-        resource '*', headers: :any, methods: [:get]
+        resource '/api/v1/*', headers: :any, methods: [:get]
+        resource '/graphql', headers: :any, methods: [:post]
       end
     end