Allow authenticators to set CORS headers

[adamcooke]

Apia currently always sets very permissive CORS headers because it has never been designed to work with any API which is authenticated on the presence of a cookie and thus CORS has not been issue as authentication should always be provided along with the request.

However, to allow for greater flexibility, this PR introduces the ability for authenticators to set CORS headers on responses without them being overridden later by the default.

The original default remains permissive (and by that I mean the 'Access-Control-Allow-Origin header will return * and the Access-Control-Allow-Methods will also return *.

Usage

To use this, you simply need to define appropriate values within your authenticator.

class MyAuthenticator < Apia::Authenticator

  def call
    cors.origin = "example.com"
    cors.methods = ["GET", "POST"]
    cors.headers = ["X-Custom"]

    # Do other authentication actions as appropriate.
  end
end

The origin can only contain a single hostname so if you support multiple hosts, you'll need to provide logic to return the appropriate value.

class MyAuthenticator < Apia::Authenticator
  

  ALLOWED_ORIGINS = ['example.com', 'example.org']

  def call
    if ALLOWED_ORIGINS.include?(request.host)
      # If the origin is permitted, return the current host name
      # as the origin
      cors.origin = request.host
    else
      # Ensure origin is set to nil otherwise the default value of *
      # will be used allowing all requests.
      cors.origin = nil
    end

    # Other authentication as appropriate...
  end
end

[jimeh]

I'm not as familiar with Apia's internals as I'd like, but at a glance this looks like it does what it says on the tin.