CORS for /upload with header

[mike-petrov]

Current Behavior

Request GET https://rest.fs.neo.org/v1/upload/<container_name> with data and name body without headers works, but if I want to set an attributes (it will be header: x-attribute-filepath: 123/123) it's being blocked by browser because of "CORS Missing Allow Origin":

related to #166, #180

Expected Behavior

Panel working fine.

Steps to Reproduce

Can be reproduced with panel.fs.neo.org if you're to upload an object

Context

panel.fs.neo.org is broken because of this.

Regression

Yes, 0.7.2 handled this fine.

Your Environment

• Version of the product used: 0.8.2

[roman-khimov]

We need to try Access-Control-Allow-Headers: "*", but per specification it's not compatible with authenticated requests.

[roman-khimov]

The core issue here, btw, its that upload can have any X-Attribute-*. We can limit it of course to some set of standard values, but it's not the best option for this interface.