It is part of the CORS spec. See http://www.w3.org/TR/cors/