handle cors preflight without auth

[bolyachevets]

Description of changes: Currently dashboard view of safe list is not working, e.g. see bcgov/entity#20463

This is a regression due to moving notify-api and ui to different domains.

Cors preflight mechanism kicks in because of domain difference, and is consequently failing because the endpoint is expecting auth token (while preflight does not supply auth tokens by design).

Failing preflight request causes the original request to fail

See (see https://cloud.google.com/functions/docs/writing/write-http-functions#cors-limitations):

"CORS limitations
For preflighted cross-origin requests, preflight OPTIONS requests are sent without an Authorization header, so they will be rejected on all HTTP functions that require authentication. Because the preflight requests fail, the main requests will also fail. To work around this limitation, use one of the following options:

• Allow unauthenticated invocations of your function.
• Host your web app and Cloud Functions on the same domain to avoid CORS. You can do this by integrating Firebase Hosting with Cloud Functions."

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the bcrs-entities-create-ui license (Apache 2.0).