Access-Control-Allow-Origin header for /api/ should use Origin domain instead of *

[bluesmoon]

When we make an API call using XMLHttpRequest to the JuliaBox API, we need to set withCredentials=true on the XHR object. This adds an Origin: <domain> header, and also passes all Cookies through.

The JuliaBox server (juliabox.org, for example) responds with an Access-Control-Allow-Origin: * header. While this is fine for requests that do not require credentials, it violates CORS for requests that do require credentials. When withCredentials=true is set, we need the actual domain in Access-Control-Allow-Origin.

With ipython, we used to set Access-Control-Allow-Origin: origin in ipython_notebook_config.py. I'm not sure what the equivalent is for jupyter, but I'm sure you do, and can make the required changes for juliabox.

Note that withCredentials=true is required because appropriate auth cookies need to be sent from the browser to juliabox in order to get data for the right user account.

[bluesmoon]

Note, this link might be relevant: http://stackoverflow.com/questions/19743396/cors-cannot-use-wildcard-in-access-control-allow-origin-when-credentials-flag-i