* fix(cors): only allow localhost
* fix: use host so it's configurable
* fix: use cors options object
* feat: use a custom graphql-server instead of the one from apollo plugin
exports the httpServer instance
* fix: add CORS validation in the http upgrade request
Co-authored-by: Haoqun Jiang <haoqunjiang@gmail.com>