Add an option to disable automatic addition of CORS header

Issues: SPR-12283