only allow cors on api routes

config/initializers/cors.rb

@@ -1,7 +1,7 @@
 Rails.application.config.middleware.insert_before 0, Rack::Cors do
   allow do
     origins '*'
-    resource '*',
+    resource '/api/*',
       headers: :any,
       methods: [:get, :post, :put, :delete, :options, :head]
   end