Translations:Manual:$wgAllowCrossOrigin/5/en

This should be disabled for intranet sites (sites behind a firewall).