Improve precision of error messages from failed CORS checks.

Improve precision of error messages from failed CORS checks.

Identify when the incoming Access-Control-Allow-Origin header value
contains multiple origin tokens and report this as not allowed.  If it
doesn't and the origin is valid, provide an error message that informs
of a mismatch between the origin strings.

The previous error message could lead users into thinking that
(white)lists of origins were supported. It is not by the spec nor
current implementations.

Removed a nearby and related FIXME; not a current concern.

R=
BUG=321517
TEST=http/tests/xmlhttprequest/origin-exact-matching

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=163406

[sof, 2013-12-08 22:25:21]

Please take a look when you get a chance.

("CORS enabling" services is proving to be troublesome&fiddly to get right for
some; anything we can do to help out via error message clarity seems well worth
it.)

[abarth-chromium, 2013-12-09 07:02:37]

lgtm

[commit-bot: I haz the power, 2013-12-09 07:02:43]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/sigbjornf@opera.com/109773002/1

[abarth-chromium, 2013-12-09 07:02:56]

Thanks for bring this code into the present.  :)

[Mike West, 2013-12-09 08:11:05]

LGTM2. Thanks for the error message improvements!

[commit-bot: I haz the power, 2013-12-09 08:14:18]

Change committed as 163406