What steps will reproduce the problem?
1. Install Prosody 0.12.0
2. Enable some HTTP modules (mod_bosh, mod_websockets, etc.)
3. Observe that CORS headers are added, with no way to disable
What version of the product are you using? On what operating system?
Please provide any additional information below.
There are some valid use-cases for disabling CORS. For example, if custom settings are desired and/or the headers are added downstream of Prosody.