Do not use cors handler at all if the config is false

[dlongley]

          Is there a reason to have the cors handler active at all if the config is false?  Perhaps a microoptimization, but the logic could omit adding the handler if not needed.

Originally posted by @davidlehn in #54 (comment)