added cors? option to castra-dev-server task

- defaults to false
- turned off by default because cors remains fickle