HttpOrigin should be disabled by default

Apparently some people struggle when it's enabled by default // cc @homakov