CORS support, enabled by default, can be disabled with config.cors = false