Add very basic support for CORS.
Add very basic support for CORS.

http://www.w3.org/TR/cors/

This is not fully tested, and is here simply to experiment with
and determine if its kosher. Works like this:

In modern browsers that support CORS, when they get an XHR for a
non-origin domain rather than just erroring out immediately, they
go ahead and make the request. If the request does not have some
special headers in it, the request is cancelled. If the request is
GET, HEAD or POST and the response has Access-Control-Allow-Origin
header with a value that matches the current domain, it is accepted.
If the request is for some other method, a thing called a preflight
request is made (which does an OPTIONS and other complex stuff).

Given that our requirement here is to support cross domain GETs, we
can add 'Access-Control-Allow-Origin: *' to the response headers when a
GET request is made, et voila the browser will accept it.

So this change does that. It's not clear if the use of '*' is the
right choice, but the result is that from cdent.tiddlyspace.org:8080
I can do this from the console of webkit:

jQuery.ajax({'url': 'http://monkey.tiddlyspace.org:8080/bags.json', 'type': 'GET', success: function(data,status,xhr) {alert(data)}})

And get the expected results. Without the header the XHR is cancelled.

Thanks paul. This is pretty cool stuff.

FND/tiddlyspace,FND/tiddlyspace,FND/tiddlyspace,TiddlySpace/tiddlyspace,TiddlySpace/tiddlyspace,TiddlySpace/tiddlyspace