z/OS Connect CORS headers can't be disabled

Question

We currently have version: z/OS Connect Enterprise Edition version 2.0.10.1 (20171016-1033)

We want to disable CORS headers and tried to set:

  <cors allowCredentials="false" allowedHeaders="sadasd"  
 allowedMethods="asdsad" allowedOrigins="http://sdsdfsdfds.adsf" domain=" 
 /                                                                        
 " id="defaultCORSConfig" maxAge="3600"/>  

We also tried to comment it out:

     <é-- <cors allowCredentials="true" allowedHeaders="Origin, Content-   
 Type, Authorization" allowedMethods="GET, POST, PUT, DELETE, OPTIONS"    
 allowedOrigins="*" domain="/" id="defaultCORSConfig" maxAge="3600"       
 /> -->                                                                   

But all that doesn't help. How can we disable CORS headers?

I couldn't find exact syntax but found contradictory information:

1. The only valid value for this header is true (case-sensitive). If you
   don't need credentials, omit this header entirely (rather than setting
   its value to false).

2. This header must be included in all valid CORS responses; omitting the
   header will cause the CORS request to fail.

Have you any idea ? Thanks so much Angela