Use same CORS policy for /@:username and /users/:username (#9485)

Fixes #8189

rack-cors being called before the application router, it does not follow
the redirection, and we need a separate rule for /users/:username.