Set Access-Control-Allow-Origin header to * on 401 responses

[cbeauchesne]

If a token is obsolete or corrupted, API answer 401 response (Not authorized).

But in this case, Access-Control-Allow-Origin header in response is not set.

This combinaison (401 + no ACAO header) is interpreted by browsers as an invalid CORS request, and thus, absolutly not response data is provided to client javascript, to prevent any invalid utilisation of CORS data.

To reproduce :

1. on client side, send a XMLTHttpRequest to API with a fake Authorization header
2. set a onreadystate callback on your request
3. Try to see the response content in javascript : impossible. However, the response exists in dev console

[lbesson]

see #1073 and Cornices/cornice#115

Updating cornice will probably solve the issue.

[lbesson]

see also #720