Changed the hard-coded defaults to completely disable CORS.  This is the most sensible scenario in interest of maximum security.