[server] headless = true enableCORS = false enableXsrfProtection = false