Fixed: explicitly turning off CORS mode when crossOrigin option is not specified.

prevent Image object from using old invalid CORS setting in case gotten from _unused array