Add setting to allow cors for all hosts

This MR adds the option to set the DJANGO_ALLOW_ALL_ORIGINS setting via an environment variable. It still has the default value of False, but we might change that for the central CV, in order to allow others to use the system too.