Security updates

Make sure crumb cookie not set when proxy handler used or when cors true and request Origin header present