This ensures that cors_allowed_origins can be set when cors_enabled is
not explicitly specified and allowed to be its default (currently true).
The current behavior is to clobber this value when cors_enabled is not
explicitly set, ultimately setting it to the default of
"serve://boundary" only.