Add option to disable CORS