I think `cors_enabled` should win, so we have an issue here, sharp eyes :)