title: Enable CORS in Golang callback function
body: <p>I have an AJAX call to Google's oAuth2 api looks like this:</p>
  
  <pre><code>$(document).on('click', '#signup', function() {
    var OAUTHURL        =  'https://accounts.google.com/o/oauth2/auth?';
    var SCOPE           =   'email profile';
    var STATE           =   'profile';
    var REDIRECT_URI    =   'https://localhost:8080/callback';
    var RESPONSE_TYPE   =   'token';
    var CLIENT_ID       =   '554886359117-8icq0dc9halr8rjd6bdtqcmagrdql9lr.apps.googleusercontent.com';
    var _url            =    OAUTHURL + 'scope=' + SCOPE + '&amp;state=' + STATE + '&amp;redirect_uri=' + REDIRECT_URI + '&amp;response_type=' + RESPONSE_TYPE + '&amp;client_id=' + CLIENT_ID;
    $.ajax({
      type: "POST",
      dataType: "text",
      url: _url,
      success: function(response)
      {
          console.log(response.url);
      },
      error: function(error)
      {
          console.log("ERROR: ", error);
      }
    });
  });
  </code></pre>
  
  <p>This is supposed to redirect back to the server running on <a href="http://localhost/callback" rel="nofollow">http://localhost/callback</a>.</p>
  
  <pre><code>Redirect URIs:  http://localhost:8080/callback
  Javascript Origins: http://localhost:8080
  </code></pre>
  
  <p>I also have the callback function defined as below:</p>
  
  <pre><code>func init() {
      r := mux.NewRouter()
  
      r.HandleFunc("/", rootHandler)
      r.HandleFunc("/callback", callbackHandler)
      http.Handle("/", r)
  }
  func callbackHandler(w http.ResponseWriter, r *http.Request) {
      fmt.Fprint(w, "I am sent back from the server!"+time.Now().Format("Mon, 02 Jan 2006 15:04:05 MST"))
  }
  </code></pre>
  
  <p>everything looks good in debugging mode, except I get this error back from google's api:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="https://accounts.google.com/o/oauth2/auth?scope=email%20profile&amp;state=profi" rel="nofollow">https://accounts.google.com/o/oauth2/auth?scope=email%20profile&amp;state=profi</a>…d=554886359117-8icq0dc9halr8rjd6bdtqcmagrdql9lr.apps.googleusercontent.com.
    No 'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost:8080" rel="nofollow">http://localhost:8080</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>I have tweaked a little around but I can't seem to find my way through.
  Any thought on this?</p>