fix: disable cors by default

[achingbrain]

Brings js-ipfs into line with go-ipfs by not having CORS on by default, instead requiring the user to explicitly configure it.

BREAKING CHANGE:

• CORS origins will need to be configured manually before use with ipfs-http-client

[achingbrain]

I've changed the default behaviour of the non-POST 405 responses.

The previous implementation was adding extra handlers for GET, DELETE, etc that just throw 405s, but it caused Hapi's built in CORS module to treat the presence of a handler for those methods as confirmation that an actual request made to that resource would have a chance of succeeding so was returning 200s for preflight requests with a Access-Control-Request-Method header of GET, for example.

To me it doesn't make sense to send a 405 in response to a preflight request as you're saying the OPTIONS method isn't allowed, which it is.

I've moved the 405-throwing behaviour to an onRequest handler, so a preflight OPTIONS request to a resource with an Access-Control-Request-Method that isn't POST will now 404. Sending the actual non-POST request will 405 as before, though it should really 404 as well, but this is RPC not REST so 🤷 .

TBH it's not a big deal as the pre-flight response is opaque to the client js if it doesn't have a 2xx status code.

As an added bonus we now send an Allow header along with the 405 response to be RFC7231 compliant.

[lidel]

I want to test this against https://webui.ipfs.io +/- CORS, but we are in the middle of release, so need to wait a bit before I get to it. Will post my review later.

[lidel]

CORS works as expected, but I think there is a regression related to /webui on API port:

• 💚 https://webui.ipfs.io is unable to use API at http://127.0.0.1:5002 without CORS safelisting
• 💚 https://webui.ipfs.io is able to use API at http://127.0.0.1:5002 when CORS safelisting is done via jsipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["https://webui.ipfs.io"]' before starting the daemon
• 💔 The WebUI URL printed to the console during jsipfs daemon start is broken: http://127.0.0.1:5002/webui
  returns 405 Method Not Allowed

[lidel]

OPTIONS, WebUI (local or remote) look fine now.
Small nit below, but other than that lgtm.