Added CorsClient (separate MVC app)
Proves that CORS is disabled by default
CORS enabled in WebAPI config