Replace CORS with an API Key based approach

[waleedkadous]

CORS is easy to hack and/or get around. We do have an API Key based approach, however, it's pretty clumsy: it's embedded as an env var. Instead we should move to a model where there are API Keys stored in the database. We don't need a graphical UI (though would be nice); we can create a command line tool for now like:

python add_api_key.py --key ... --desc " ..."