Added ability to add custom log message to router "bind" method, to make it easier to tell what's being bound.
Added "log" option to controller action and policy functions
Now with sails lift --silly, you can see what is being bound to each route--no more mystery double log messages.
Updated the way the router binding log works
Use "_middlewareFn" key of the bound function if available, so we only have to use the options hash as a last resort
Added _middlewareFn key and/or function names wherever possible in hooks
Added a CORS catchall route handler that denies requests from disallowed domains
Added a CORS preflight route handler that basically says yes to everything
Updated CSRF protection
CSRF check is always made now it protectionEnabled is on, but the token is only set if its from an approved origin (or is not cross-domain)
Updated CSRF tests
skipping a couple of OPTIONS tests that don't work right now
Fixed clearHeaders definition
Added "Access-Control-Allow-Credentials" to x-domain /csrfToken response
Only set headers if they'll have values
Prevents sending a header in the response with a value of "undefined"
Skip same-origin requests in CORS catchall, but catch everything else even if no access control header was set
Simplified CORS+CSRF handling
In CSRF hook, added /csrfToken route directly to sails.config.routes so that CORS hook will process it like every other route.  This also allowed simplification of the route handler--no need for more CORS checks since the CORS hook will handle it.
In CORS hook, removed all references to CSRF entirely; it's just another route now.  Also removed code related to sending 403 responses for socket requests on bad origins, since we're doing that for ALL requests now regardless of transport.
Updated CORS/CSRF tests
Removed unused _.defaults var.
Don't smash lodash defaults
0.10.0-rc10
Merge branch 'master' of https://github.com/balderdashy/sails into sailor

* 'master' of https://github.com/balderdashy/sails:
  0.10.0-rc10
  Don't smash lodash defaults
  Removed unused _.defaults var.
  Updated CORS/CSRF tests
  Simplified CORS+CSRF handling In CSRF hook, added /csrfToken route directly to sails.config.routes so that CORS hook will process it like every other route.  This also allowed simplification of the route handler--no need for more CORS checks since the CORS hook will handle it. In CORS hook, removed all references to CSRF entirely; it's just another route now.  Also removed code related to sending 403 responses for socket requests on bad origins, since we're doing that for ALL requests now regardless of transport.
  Skip same-origin requests in CORS catchall, but catch everything else even if no access control header was set
  Only set headers if they'll have values Prevents sending a header in the response with a value of "undefined"
  Added "Access-Control-Allow-Credentials" to x-domain /csrfToken response
  Fixed clearHeaders definition
  Updated CSRF tests skipping a couple of OPTIONS tests that don't work right now
  Updated CSRF protection CSRF check is always made now it protectionEnabled is on, but the token is only set if its from an approved origin (or is not cross-domain)
  Added a CORS catchall route handler that denies requests from disallowed domains Added a CORS preflight route handler that basically says yes to everything
  Updated the way the router binding log works Use "_middlewareFn" key of the bound function if available, so we only have to use the options hash as a last resort Added _middlewareFn key and/or function names wherever possible in hooks
  Added "log" option to controller action and policy functions Now with sails lift --silly, you can see what is being bound to each route--no more mystery double log messages.
  Added ability to add custom log message to router "bind" method, to make it easier to tell what's being bound.