fix(server): register cors before static endpoints

src/app.js

@@ -51,6 +51,11 @@ const configureApp = app => {
   app.use(bodyParser.urlencoded({ extended: false }))
   app.use(cookieParser())
   app.use(helmet())
+
+  // Allow CORS from client if host / port is different
+  const CORSConfig = createCORSConfig()
+  app.use(cors(CORSConfig))
+
   app.use(express.static(path.resolve('.', '_build')))
   app.use(express.static(path.resolve('.', 'static')))
 
@@ -61,10 +66,6 @@ const configureApp = app => {
     )
   }
 
-  // Allow CORS from client if host / port is different
-  const CORSConfig = createCORSConfig()
-  app.use(cors(CORSConfig))
-
   // Register passport authentication strategies
   app.use(passport.initialize())
   const authentication = require('pubsweet-server/src/authentication')