Disable Rack::Protection::HttpOrigin to avoid session issue under reverse proxy env