disable cors header by default

contrib/sample-cfg.yaml

@@ -36,13 +36,13 @@ auth:
 
 ### uncomment to enable CORS headers
 ### see: https://godoc.org/github.com/rs/cors#Options
-cors:
-  allowed-origins: ['*']
-  allowed-methods:
-    - GET
-    - PUT
-    - POST
-    - PATCH
-    - DELETE
-  allowed-headers: ['*']
-  max-age: 10
+# cors:
+#   allowed-origins: ['*']
+#   allowed-methods:
+#     - GET
+#     - PUT
+#     - POST
+#     - PATCH
+#     - DELETE
+#   allowed-headers: ['*']
+#   max-age: 10