HTTP access control: send headers only when needed

This is relevant for simple requests (not the preflighted ones).
When header Origin is present, the server will add necessary
HTTP access control headers.
HTTP access control preflight: specify max age
Doc: move sidebars to subdirectory
Doc: add create client