Disable CORS for admin routes #155
Description
Currently, all available routes has CORS enabled, meaning that you can send requests to the API from anywhere. In the future, it might be a good idea to not allow this for admin routes to improve security.
Adonis allows for dynamic configuration of the CORS policy based on the request method. Disabling CORS for all POST, PUT and DELETE operation should do the trick (with some exceptions).