939 [CORS] By default none of the origins, headers or exposed headers should be allowed