Enable CORS for debug instances only