Run CORS handler first for /api routes (#7967)

Signed-off-by: Tamal Saha <tamal@appscode.com>

routers/routes/routes.go

@@ -41,6 +41,7 @@ import (
 	"gitea.com/macaron/binding"
 	"gitea.com/macaron/cache"
 	"gitea.com/macaron/captcha"
+	"gitea.com/macaron/cors"
 	"gitea.com/macaron/csrf"
 	"gitea.com/macaron/i18n"
 	"gitea.com/macaron/macaron"
@@ -951,9 +952,14 @@ func RegisterRoutes(m *macaron.Macaron) {
 		m.Get("/swagger.v1.json", templates.JSONRenderer(), routers.SwaggerV1Json)
 	}
 
+	var handlers []macaron.Handler
+	if setting.EnableCORS {
+		handlers = append(handlers, cors.CORS(setting.CORSConfig))
+	}
+	handlers = append(handlers, ignSignIn)
 	m.Group("/api", func() {
 		apiv1.RegisterRoutes(m)
-	}, ignSignIn)
+	}, handlers...)
 
 	m.Group("/api/internal", func() {
 		// package name internal is ideal but Golang is not allowed, so we use private as package name.