To be a bit cleaner could this be two separate methods: `cors_enabled?` and `allow_cross_origin`?