Add default of FALSE to allowing all origins in cross-domain requests. Remove old CORS code that was commented out.