[MRG] Disable cross-domain access by default. See GH-89 and GH-63.

/cc @andresp99999 - what do you think? Could you please review and merge this PR if you're OK with it?