Made CORS headers configurable, they're not needed in production