feat(conf): do not insert CORS middleware if ALLOWED_URL is "unset"

Ophestrarequested to merge
cors-disable into main

This allows easy disablement of CORS for testing.

Merge request reports