First, it's disabled by default. Second, enabling it seems to do nothing but turn the icon green. The CORS security idiocy still happens.