title: How do I permit cross-origin resource sharing selectively by authorization information?
body: <p>Some users of my service wish to be able to access our REST API (which requires user credentials) via javascript in a browser. I will not allow this generally due to all of the vulnerabilities associated with violating the same origin policy. But if a specific user needs it and understands what is going on... I wish to add him to a "can make cross origin request" whitelist.</p>
  
  <p>However, I cannot figure out how to selectively return a Access-Control-Allow-Origin header based on http authorization information.</p>
  
  <p>If I do this in javascript:</p>
  
  <pre><code>$.ajax({'url':'url', 'beforeSend': function (xhr) { xhr.setRequestHeader("Authorization", "Basic " + 'base64encodedcreds' ) } })
  </code></pre>
  
  <p>The browser first sends an ORIGIN METHOD request without the Authorization header.  Consequently, there is no way for me to know if I should include Access-Control-Allow-Origin in the response.</p>
  
  <p>Is there some setting in the xmlhttprequest to get it to send an ORIGIN with the authorization? Or is there another way to selectively grant cross-origin access?</p>