The implementation (introduced by
2084f33a) was to permissive and posed a
security risk. As a consequence, cross origin requests requiring client
authentication are no longer possible.