[MRG] Disable cross-domain access by default.

/cc @andresp99999 - what do you think? Could you please review and merge this PR if you're OK with it?

See GH-89 and GH-63.