Fixing default cors settings

Here's another small one: The default CORS=true setting is broken. This fixes it, so cors is enabled by default.