KL-1: core_allowed_origins example config should be empty

config/core.config.toml

@@ -333,7 +333,7 @@ auth_rate_limit_window_seconds = 60
 ## Production setups should configure this explicitly.
 ## Env: KOMODO_CORS_ALLOWED_ORIGINS
 ## Default: empty
-cors_allowed_origins = ["*"]
+cors_allowed_origins = []
 
 ## Tell CORS to allow credentials in requests.
 ## Set true only if needed for authentication proxy.