Add Access-Control-Allow-Origin before aborting about cors

[rs]

Re-reading the spec, I'm not sure we should stop the processing of the preflight request until there is a parsing error. I might revisit this.

[bithavoc]

When the browser uses <img crossOrigin=Anonymous> there is no pre-flight and this line here halts the execution before isOriginAllowed realizes the desired * origins.

Should I open a separate issue or are we talking about the same thing?

[rs]

Yes, I think it's a different issue.

[jub0bs]

@tj For what it's worth, I mentioned this issue in my latest my blog post.

[jub0bs]

Related: whatwg/fetch#1588

[jub0bs]

FWIW, I've implemented some debug mode in jub0bs/cors that changes the way the middleware composes responses to preflight requests, and which can be toggled on the fly. Perhaps something to consider for rs/cors.