sup-3302 #comment disable CORS cookie on ajax by default #time 4h