ok, after some digging I manage to fix it with following middleware configuration. However it now returns octet-stream for all JSON responses, is there a way to fix it? I also would be grateful for some kind of explanation of what's going on here (I realize it's because wrap-content middleware but I don't get why Ring strip content-type header from static content if I omit it - so how can I have both?)
(def app
(api
(assoc api-config
:middleware
[[wrap-cors :access-control-allow-origin [#"\\*"] :access-control-allow-methods [:get :post :put :delete :patch]]
wrap-reload
[wrap-defaults (-> site-defaults
(assoc-in [:responses :not-modified-responses] true)
(assoc-in [:static :resources] resources-root)
(assoc-in [:security :anti-forgery] false)
(assoc-in [:security :frame-options] :deny)
(assoc-in [:security :ssl-redirect] (not (:dev env)))
(assoc-in [:security :hsts] (not (:dev env))))]])