Allow setting http.cors.enabled through puppet.

ES 1.4.0 defaults to false compared to 1.3.x