New: CORS support on the API (for developing against the API)

src/NzbDrone.Api/Extensions/AccessControlHeaders.cs

@@ -0,0 +1,12 @@
+namespace NzbDrone.Api.Extensions
+{
+    public static class AccessControlHeaders
+    {
+        public const string RequestMethod = "Access-Control-Request-Method";
+        public const string RequestHeaders = "Access-Control-Request-Headers";
+
+        public const string AllowOrigin = "Access-Control-Allow-Origin";
+        public const string AllowMethods = "Access-Control-Allow-Methods";
+        public const string AllowHeaders = "Access-Control-Allow-Headers";
+    }
+}

src/NzbDrone.Api/Extensions/Pipelines/CorsPipeline.cs

@@ -0,0 +1,47 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Nancy;
+using Nancy.Bootstrapper;
+
+namespace NzbDrone.Api.Extensions.Pipelines
+{
+    public class CorsPipeline : IRegisterNancyPipeline
+    {
+        public void Register(IPipelines pipelines)
+        {
+            pipelines.AfterRequest.AddItemToEndOfPipeline(Handle);
+        }
+
+        private void Handle(NancyContext context)
+        {
+            if (context == null || context.Response.Headers.ContainsKey(AccessControlHeaders.AllowOrigin))
+            {
+                return;
+            }
+
+            ApplyResponseHeaders(context.Response, context.Request);
+        }
+
+        private static void ApplyResponseHeaders(Response response, Request request)
+        {
+            var allowedMethods = "GET, OPTIONS, PATCH, POST, PUT, DELETE";
+
+            if (response.Headers.ContainsKey("Allow"))
+            {
+                allowedMethods = response.Headers["Allow"];
+            }
+            
+            var requestedHeaders = String.Join(", ", request.Headers[AccessControlHeaders.RequestHeaders]);
+
+            response.Headers.Add(AccessControlHeaders.AllowOrigin, "*");
+            response.Headers.Add(AccessControlHeaders.AllowMethods, allowedMethods);
+
+            if (request.Headers[AccessControlHeaders.RequestHeaders].Any())
+            {
+                response.Headers.Add(AccessControlHeaders.AllowHeaders, requestedHeaders);
+            }
+        }
+    }
+}