Reproduce CORS missing headers

[leplatrem]

As a good start, ticket #48 is reproduced in a test case :)

[almet]

Sweet, that will help :)

[Natim]

Note that we also probably want forbidden 401 to return JSON.

[Natim]

According to https://github.com/spiral-project/daybed/blob/master/daybed/views/errors.py it should be the case.

[Natim]

The problem is that if we provide the Authorization header that doesn't validates for any reason, pyramid and pyramid_hawk stops the request.

I am not sure about the strategy:

• Should we make sure daybed.js or backbone-daybed doesn't send the Authorization header for OPTIONS request's types.
• Should we allow daybed to answer OPTIONS calls even if the Authorization header is broken?

What do you guys think?

[almet]

headers aren't sent in this particular case, but that's not the only problem.

I was working on a patch about that yesterday, but still a work in progress.

[almet]

(the missing header is the ORIGIN one, since self.headers isn't sent as part of the request)

[almet]

This latest changes should fix it.

Hope the code explains itselfs enough :)

[almet]

updated.

[leplatrem]

Great! Thanks!