Configuration with no allowed origin sets allow credentials to true

[blcham]

This happens as the following if section is always executed:

        allowedOrigins.addAll(Arrays.asList(allowedOriginsConfig.split(",")));
        if (!allowedOrigins.isEmpty()) {
            corsConfig.setAllowedOrigins(allowedOrigins);
            corsConfig.setAllowCredentials(true);
        }

After the execution, the allowedOrigin list always contains at least one element. If allowedOriginsConfig == ""
then at least an empty string (i.e.,"").