pub async fn cors(req: Request, next: Next) -> Response
Browser clients (Element, Cinny) call from another origin: answer preflights and allow it.