Added ability to add custom log message to router "bind" method, to make it easier to tell what's being bound.
Added "log" option to controller action and policy functions
Now with sails lift --silly, you can see what is being bound to each route--no more mystery double log messages.
Updated the way the router binding log works
Use "_middlewareFn" key of the bound function if available, so we only have to use the options hash as a last resort
Added _middlewareFn key and/or function names wherever possible in hooks
Added a CORS catchall route handler that denies requests from disallowed domains
Added a CORS preflight route handler that basically says yes to everything
Updated CSRF protection
CSRF check is always made now it protectionEnabled is on, but the token is only set if its from an approved origin (or is not cross-domain)
Updated CSRF tests
skipping a couple of OPTIONS tests that don't work right now
Fixed clearHeaders definition
Added "Access-Control-Allow-Credentials" to x-domain /csrfToken response
Only set headers if they'll have values
Prevents sending a header in the response with a value of "undefined"
Skip same-origin requests in CORS catchall, but catch everything else even if no access control header was set
Simplified CORS+CSRF handling
In CSRF hook, added /csrfToken route directly to sails.config.routes so that CORS hook will process it like every other route.  This also allowed simplification of the route handler--no need for more CORS checks since the CORS hook will handle it.
In CORS hook, removed all references to CSRF entirely; it's just another route now.  Also removed code related to sending 403 responses for socket requests on bad origins, since we're doing that for ALL requests now regardless of transport.
Updated CORS/CSRF tests
Removed unused _.defaults var.
Don't smash lodash defaults
0.10.0-rc10
Merge remote-tracking branch 'upstream/master'

Conflicts:
	lib/hooks/controllers/onRoute.js