Don't add CORS headers for Webfinger in production

The reverse proxy should handle it.

app/controllers/webfinger_controller.rb

@@ -54,7 +54,8 @@ class WebfingerController < ApplicationController
   end
 
   def allow_cross_origin_requests
-    headers['Access-Control-Allow-Origin'] = '*'
+    return unless Rails.env.development?
-    headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, OPTIONS'
+    headers['Access-Control-Allow-Origin'] = "*"
+    headers['Access-Control-Allow-Methods'] = "GET"
   end
 end