yiisoft/yii2 — pull request #4388 by pgaultier (2014-07-21 13:28:14+00:00)
Title: Bugfix/cors

The was two mistakes in Access-Control-Allow-Methods :
* ` s` was missing
* list of allowed methods is now sent (as expected) and not only the requested method

The default value for Access-Control-Allow-Credentials has been changed from `true` to `null`