Allows sails.config.csrf.allowCORS to be set (boolean) in order to specify whether or not you would like /csrfToken to be accessible in cross-domain AJAX requests. Prior to this fix, all CORS requsts to /csrfToken returned a null CSRF token.
Merge branch 'master' of https://github.com/balderdashy/sails

Conflicts:
	lib/hooks/csrf/index.js
Allows origins to be specified in the CSRF settings in order to allow third parties access to CSRF tokens. This use case is necessary for APIs hosted on subdomains.
Update actionUtil to support `populate` within req
Update actions to new populateEach method signature
Merge branch 'master' of https://github.com/lwansbrough/sails into lwansbrough-master
Move default "OPTIONS" handler after code that sets headers for CORS requests
Corrected handling of route-level CORS config by checking for keys rather than defaulting to Sails config if key was falsy
Fixed code that replaces CSRF token in clearHeaders to check for new "protectionEnabled" config
Refactored route binding in "request" hook to use declarative pattern using "before" key.
Also, removed logic that made request hook wait for responses hook.  This way things like "_sails" are added to the request as early as possible, making it possible for the responses like res.forbidden, which use those features, to be used inside other hooks (namely CSRF).
Use res.forbidden() in case of CSRF failure, to ensure a nice 403 response.
Refactored httpHelper to allow for more HTTP methods
Added CSRF and CORS tests (almost complete)
Merge branch 'master' of https://github.com/balderdashy/sails
Add integration tests for `populate` option
Added more CSRF tests
Merge branch 'master' into lwansbrough-master
Added tests for CORS + CSRF.
Merge branch 'master' of https://github.com/jasonsims/sails into jasonsims-master
Merge remote-tracking branch 'upstream/master'
`reverseAssociation` should not be defined as a global var
Fix misfire a publishAdd when to-One and to-Many in same model