CORS can be disabled by omitting conf.origins.