spumko/hapi — pull request #1091 by heskew (2013-10-02 22:56:22+00:00)
Title: Only set access-control-allow-origin if the origin header value matches (or '*' is allowed)

I don't necessarily want to make known which origins are allowed for a private service. I could see allowing '*' to always be sent as a sign that this is a public service so this diff might not be the perfect (ish) solution.