CORS - fuck IE7, prevent delete file reqs for UAs that utilize XDomainRequest, allow credential passing for CORS requests