Moving CORSFilter to the controller.cors package, so that removing the
package would remove CORS completely...