refactor the algorithm for testing the cors

while here:
- send cors headers even if the status is 404
- add: access_control_expose_headers config option - list of additional headers sent in Access-Control-Expose-Headers
- add: access_control_allow_credentials config option - if true return Access-Control-Allow-Credentials header equal "true"

winixd/core/config.h

@@ -984,10 +984,23 @@ public:
 	bool allow_all_cors_origins;
 
 	// list of allowed origins in cors requests
+	// can be set per controller in a method: virtual bool FunctionBase::IsCorsOriginAvailable(const std::wstring & origin_url)
 	// used only if allow_all_cors_origins is false
 	// default: empty
 	std::vector<std::wstring> allowed_cors_origins;
 
+	// list of additional headers sent in Access-Control-Expose-Headers header
+	// can be set per controller in a method: virtual void FunctionBase::AddAccessControlExposeHeadersHeader()
+	// default: empty
+	std::vector<std::wstring> access_control_expose_headers;
+
+	// if true return Access-Control-Allow-Credentials header equal "true"
+	// whethert credentials (e.g. cookies, authorization headers) are available in cors requests
+	// can be set per controller in a method: virtual bool FunctionBase::AreCorsCredentialsAvailable()
+	// default: false
+	bool access_control_allow_credentials;
+
+
 
 	Config();
 	bool ReadConfig(const std::wstring & config_file);