Added CORS package, added flag to make it optional