Setting 'security.cors.origins' did not have any effect since the the
configuration was overriden by the default path settings.