separate backend base url from frontend (#1819)

* separate backend base url from frontend

This is needed for auth, and to support a different location for the backend api server,
than the frontend.

 part of chanzuckerberg/cellxgene#1778

new server config parameters:   app__api_base_url,   app__web_base_url

Also changed api_base_url in the oauth config section to "oauth_api_base_url" to
be less confusing with the app's api_base_url

Other minor changes:

changed how the jwt decode options are handled.
Previously they needed to be set in a test case, and there was some extra logic to handle that.
Now they are handled through comfig parameters, which makes it more general.

Also, add a feature to set the CORS support credentials, which seems
to be necessary for the backend/frontend separation, at least when run
locally.  This part is sort of experimental, and may be removed or changed later.

server/cli/launch.py

@@ -296,7 +296,7 @@ class CliLaunchServer(Server):
             "application/octet-stream",
         ]
         Compress(app)
-        if app_config.server_config.app__debug:
+        if app_config.server_config.app__cors_supports_credentials or app_config.server_config.app__debug:
             CORS(app, supports_credentials=True)