[server] enableXsrfProtection = true enableCORS = true