may-day/wsgicors — pull request #1 by ryankshaw (2013-02-25 23:31:52+00:00)
Title: allow credentials in GET requests

I think you might have thought that the only
thing you'd have to set in a non-OPTIONS
request was Access-Control-Allow-Origin,
but if you are trying to pass cookies, you also
need to allow Access-Control-Allow-Credentials.

see: https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Access-Control-Allow-Credentials