Allow Origin API

[ryan]

An API for controlling delivery of Access-Control-Allow-Origin and friends that handles SSL and domain mapped scenarios.

[scribu]

Something like this would be very useful for all AJAX requests.

[ryan]

In [20794]:

API for allowing cross origin resource sharing.

• Allowed origin whitelist that can be altered by plugins
• Validation of the request origin against the whitelist
• Send Access-Control-Allow-Origin if origin allowed
• get_http_origin(), get_allowed_http_origins(), is_allowed_http_origin(), send_origin_headers()

See #20681

[ryan]

Try it out. Reopen with comments and suggestions.

[ryan]

Attempt loading preview over ssl if admin is ssl

[ryan]

Now with fewer typos.