Some adjustments

[henri-hulski]

This PR do 3 things:

• Omit the Access-Control-Allow-Credentials header when allow_credentials is not True.
  See documentation.
• Set Vary header to 'Origin' when allowed_origin specifies a URI.
  See documentation.
• Set allow_credentials by default to False.
  Specifying "*" as a wildcard for the Access-Control-Allow-Origin header is only allowed for
  requests without credentials.
  So the default 'allowed_origin': '*' and 'allow_credentials': True are in conflict which each other.

[henri-hulski]

@kagesenshi Could you have a look if I'm not missing something. I make the adjustments after reading the Mozilla documentation. Maybe in practice it looks different.

[kagesenshi]

hmm .. while the Vary header is ok, allow-credentials header i think i need some time to validate,

as not returning true for that might cause browser to ignore the resource if the resource have credentials (authorization header, cookie, tls cert). Probably should return true if user is authorized, but i'll look at that later.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials#Directives

[henri-hulski]

Not sure if I follow. After the PR, when allow_credentials setting is True the Access-Control-Allow-Credentials header will be set to 'true'. When allow_credentials setting is False the Access-Control-Allow-Credentials header will be omitted.

The third change is setting the allow_credentials setting by default to False as if it would be True it would be in conflict with the default setting for allowed_origin: '*', which is only allowed for requests without credentials.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#Directives

[henri-hulski]

@kagesenshi Are you able to review the PR like this or should I split it in 3 PRs for each commit?

[henri-hulski]

@kagesenshi @faassen @href could someone of you review this PR?
I really would like to release more.cors as I need it for morepath-realworld-example-app which I would like to puplish.
Together with the frontend cerebral-realworld-example-app which is also nearly ready now.

[href]

As someone without any CORS knowledge I think I should not weigh in on this.

[henri-hulski]

@blaflamme Maybe you can review? I remember you also worked on CORS integration.