ignore http_origin, set access_control_allow_origin to null
remove x-frame-options