web.xml: cross-origin filter must never be used with default allowedOrigins "*" (otherise XSS/CSRF issues)
2.0.0-RC2 (same changelog as in 2.0.0-RC1)