Change to only send CORS settings to API

Change to only send CORS settings to API class to avoid sending keys to public facing interface and avoid exploits of them.

Author: abetwothree

src/echo-server.ts

@@ -121,7 +121,7 @@ export class EchoServer {
             this.channel = new Channel(io, this.options);
             this.redisSub = new RedisSubscriber(this.options);
             this.httpSub = new HttpSubscriber(this.server.express, this.options);
-            this.httpApi = new HttpApi(io, this.channel, this.server.express, this.options);
+            this.httpApi = new HttpApi(io, this.channel, this.server.express, this.options.apiOriginAllow);
             this.httpApi.init();
 
             this.onConnect();