Use cors_allowed_origins in AsyncServer

[MatthewScholefield]

I needed CORS on my entire app, so I used app.add_middleware(CORSMiddleware, ...) with a specific origin. This broke websockets because it caused duplicate headers for requests to /ws/*:

access-control-allow-origin: http://localhost:3000
access-control-allow-credentials: true
access-control-allow-credentials: true
access-control-allow-origin: http://localhost:3000

(For some reason this messed up Firefox's CORS verification) So, I tried to explicitly disabling it with cors_allowed_origins=[], but I realized the parameter wasn't being used. This PR fixes that. Note that I changed the default parameter to "*" so that the behavior would remain unchanged.

[pyropy]

Thank you so much for contributing, will make sure to add you to list of contributors ❣️

Merged 🚀🎉