Disables CORS by default, only exception is `/api/errors`.