CORS allowed origins doesn't work on per-route basis

**Node version**: 12.14.0 (also tried on 8.17.0)
**Sails version** _(sails)_: 1.2.4 (issue also exists in 1.0.2)
**ORM hook version** _(sails-hook-orm)_: 2.1.1
**Sockets hook version** _(sails-hook-sockets)_: 2.0.0
**Organics hook version** _(sails-hook-organics)_:
**Grunt hook version** _(sails-hook-grunt)_: 4.0.0
**Uploads hook version** _(sails-hook-uploads)_:
**DB adapter & version** _(e.g. sails-mysql@5.55.5)_:
**Skipper adapter & version** _(e.g. skipper-s3@5.55.5)_:

## Issue

I created two [client](https://github.com/nino-vrijman/sails-cors-issue-client) and [server](https://github.com/nino-vrijman/sails-cors-issue-server) repositories in which you should be able to reproduce this issue, see the READMEs on how to run it. I also deployed the [client](https://agile-stream-19956.herokuapp.com/) and [server](https://tranquil-tundra-49110.herokuapp.com/) on Heroku.

I was trying to implement the allowOrigins CORS setting on a per route basis and I noticed it wasn't working. The `Access-Control-Allow-Origin` wouldn't be set to the value I specified in the CORS dictionary of a single route which should be possible according to the [docs](https://sailsjs.com/documentation/concepts/security/cors#?configuring-cors-for-individual-routes).

I created a simple action in my UserController called test which just returns 'ok' which should only allowed to be called from https://some-domain.com but when I run the client in the repo above (which runs on on Heroku / localhost) I get a 200 response with an `Access-Control-Allow-Origin` header value of '*' (equal to my global CORS configuration) while I expected it to fail because I set the route to only allow requests from https://some-domain.com (see below).

### Implementation

My implementation in `config/routes.js`:
```JavaScript
'GET /test': {
action: 'user/test',
cors: {
allowOrigins: ['https://somedomain.com'],
},
},
```

Most related issue's where closed and I couldn't find an answer / solution to my problem.

### Workaround

The workaround I used for now is to just include all domains in the global CORS allowOrigins configuration.

Edit: split the reproduction repository up into a separate client and server repository and added links to the apps on Heroku

Start with the linked client and server reproduction repositories and follow their READMEs to run the example. Inspect the per-route entry in config/routes.js and compare its CORS behavior with the global configuration. Done means requests to /test use the route-specific allowOrigins value rather than the global wildcard.

Written by the indexing model from the issue text.