fix: always add public url to allowed cors origins

This fixes a bug where it was not possible to do anything because the public url was not allowed by default for CORS requests.

Regression from 433b8b9115

Resolves https://github.com/go-vikunja/vikunja/issues/916

pkg/config/config.go

@@ -599,6 +599,9 @@ func InitConfig() {
 	if DefaultSettingsTimezone.GetString() == "" {
 		DefaultSettingsTimezone.Set(ServiceTimeZone.GetString())
 	}
+
+	publicURL := strings.TrimSuffix(ServicePublicURL.GetString(), "/")
+	CorsOrigins.Set(append(CorsOrigins.GetStringSlice(), publicURL))
 }
 
 func random(length int) (string, error) {

pkg/routes/routes.go

@@ -182,6 +182,7 @@ func RegisterRoutes(e *echo.Echo) {
 
 	// CORS
 	if config.CorsEnable.GetBool() {
+		log.Debugf("CORS enabled with origins: %s", strings.Join(config.CorsOrigins.GetStringSlice(), ", "))
 		e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
 			AllowOrigins: config.CorsOrigins.GetStringSlice(),
 			MaxAge:       config.CorsMaxAge.GetInt(),