Disable CORS by default.