Fix Access-Control-Allow-Headers header; Fix case when cors is not set

[alexsong93]

• Fix 'Access-Control-Allow-Headers` header getting removed
• Do not modify cors headers when cors is not set in the config
• Strip all cors headers if cors is set to false in the config