don't include authorization header in cross domain requests
check auth token presence first
better var names
added cross domain whitelisting
better spec wording
documentation for CORS
better name for the setting
added missing docs
fixed typo