Comment out CORS by default, because it may be a security risk if not set properly