Allow disabling CORS for individual route. Closes #1175