force CORS middleware to be the first

This is a possible fix for #144.

src/rc3platform/settings/default.py

@@ -71,11 +71,14 @@ if IS_BACKOFFICE:
 if IS_API or IS_BACKOFFICE:
     INSTALLED_APPS += ['corsheaders']  # noqa: F405
     # insert CORS middleware before Django's CommonMiddleware
-    MIDDLEWARE.insert(max(MIDDLEWARE.index('django.middleware.common.CommonMiddleware'), 0), 'corsheaders.middleware.CorsMiddleware')  # noqa: F405
+    MIDDLEWARE.insert(0, 'corsheaders.middleware.CorsMiddleware')  # noqa: F405
 
     # CORS spec
+    CORS_ALLOWED_ORIGINS = [
+        'https://visit.at.rc3.world',
+    ]
     CORS_ALLOWED_ORIGIN_REGEXES = [
-        r'^https://([\w\d-]+\.)*rc3.world$',
+        r'^https:\/\/([\w\d-]+\.)*rc3\.world$',
     ]
     CORS_URLS_REGEX = r'^/api/.*$'