Add an option to turn off CSP/CORS policies for some clients with known issues

Some schools that use services like Securly reroute all traffic and this breaks the website since the Access-Control-Allow-Origin header is not present in the response.