All ZeroMux sites not work when UiPassword plugin enabled

AJAX requests contain credentials, but by default credentials are stripped in cross-origin requests.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Requests_with_credentials

The most interesting capability exposed by both XMLHttpRequest or Fetch and CORS is the ability to make "credentialed" requests that are aware of HTTP cookies and HTTP Authentication information. By default, in cross-site XMLHttpRequest or Fetch invocations, browsers will not send credentials. A specific flag has to be set on the XMLHttpRequest object or the Request constructor when it is invoked.
invocation.withCredentials = true;

[x] Added to ZeroMux

MDN points out that, despite a GET request will not be preflighted, the server is required to send back this access control header:

Access-Control-Allow-Credentials: true

The same applies to crossorigin attribute:

"use-credentials" A cross-origin request (i.e. with Origin: HTTP header) is performed with credential is sent (i.e. a cookie, a certificate and HTTP Basic authentication is performed). If the server does not give credentials to the origin site (through Access-Control-Allow-Credentials: HTTP header), the image will be tainted and its usage restricted.

It seems that ZeroNet sends back this header only when the request is preflighted.

[ ] Source code of ZeroNet has been changed accordingly.

Another issue is that Firefox complains:

Credential is not supported if the CORS header Access-Control-Allow-Origin is *

According to the CORS article on MDN,

For requests without credentials, the server may specify "*" as a wildcard, thereby allowing any origin to access the resource.

By changing the value of Access-Control-Allow-Origin to null seems to solve this issue.

[ ] Source code of ZeroNet has been changed accordingly.

A third issue is that Web Fonts are required to be fetched anonymously. This is controversial but it is defined and implemented.

CSS Fonts Module Level 3 says that user agents must use "Anonymous" mode of CORS-enabled fetch [1], that means credentials are not sent regardless of server's Access-Control-Allow-Credentials header. (XMLHttpRequest change of Chrome 37 is unrelated to font fetches.)

[1] http://www.w3.org/TR/css3-fonts/#font-fetching-requirements

Therefore there is no easy solution to use Web Font with UiPassword plugin enabled. Perhaps we can put credential information into Referrer header or Query String, but that is far from the scope of this issue ticket.

MuxZeroNet / ZeroMux

All ZeroMux sites not work when UiPassword plugin enabled #5