Allow Origin API

[ryan]

An API for controlling delivery of Access-Control-Allow-Origin and friends that handles SSL and domain mapped scenarios.

Something like this would be very useful for all AJAX requests.

In [20794]:

API for allowing cross origin resource sharing.

• Allowed origin whitelist that can be altered by plugins
• Validation of the request origin against the whitelist
• Send Access-Control-Allow-Origin if origin allowed
• get_http_origin(), get_allowed_http_origins(), is_allowed_http_origin(), send_origin_headers()

See #20681

Try it out. Reopen with comments and suggestions.

Attempt loading preview over ssl if admin is ssl

Now with fewer typos.