Incorrect CORS-related env vars parsing

[MOZGIII]

Consider this code:

hydra/cmd/server/handler.go

Lines 57 to 60 in 56aa5d2

	AllowedOrigins: strings.Split(viper.GetString("CORS_ALLOWED_ORIGINS"), ","),
	AllowedMethods: strings.Split(viper.GetString("CORS_ALLOWED_METHODS"), ","),
	AllowedHeaders: strings.Split(viper.GetString("CORS_ALLOWED_HEADERS"), ","),
	ExposedHeaders: strings.Split(viper.GetString("CORS_EXPOSED_HEADERS"), ","),

When a missing or empty CORS_EXPOSED_HEADERS is being parsed, the result contains an array with a single element - empty string, instead of it being an empty array.
Same applies to the rest. This breaks how CORS are handled.

[aeneasr]

Thank you for reporting this, it's a bug indeed (caused by strings.split always returning at least one element, an empty string)