IR-API: Keep CORS List updated for the cluster, then for the frontend

[keiranjprice101]

Description of the issue

When we can determine the CORS options, we need to update ALLOWED_ORIGINS to be restrictive, allowing only from within the cluster and from the frontend domain