Variable corsHeadersConst

Default CORS headers for all responses

Note: Access-Control-Allow-Origin is not included by default because:

1. Using '*' with credentials is rejected by browsers
2. The correct origin depends on the request and security requirements

Use CorsConfig to properly configure CORS for your use case.