Added service protocol cross-origin access from localhost for http requests

runtime/bin/vmservice/server.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of vmservice_io;
 
 class WebSocketClient extends Client {
   static const int PARSE_ERROR_CODE = 4000;
   static const int BINARY_MESSAGE_ERROR_CODE = 4001;
   static const int NOT_MAP_ERROR_CODE = 4002;
@@ skipping 78 matching lines @@
     close();
   }
 
   void post(dynamic result) {
     if (result == null) {
       close();
       return;
     }
     HttpResponse response = request.response;
     response.headers.contentType = jsonContentType;
-    final uri = Uri.parse(request.headers['Origin'].single ?? '');
-    final noPortOrigin = new Uri(host: uri.host, scheme: uri.scheme).origin;
-    if (_allowedOrigins.contains(noPortOrigin)) {
-      response.headers.add('Access-Control-Allow-Origin', uri.origin);
+    final origins = request.headers['Origin'];
+    if ((origins != null) && (origins.isNotEmpty)) {
+      final uri = Uri.parse(origins.first);
+      final noPortOrigin = new Uri(host: uri.host, scheme: uri.scheme).origin;
+      if (_allowedOrigins.contains(noPortOrigin)) {
+        response.headers.add('Access-Control-Allow-Origin', uri.origin);
+      }
     }
     if (result is String) {
       response.write(result);
     } else {
       assert(result is List);
       Uint8List cstring = result[0];  // Already in UTF-8.
       response.add(cstring);
     }
     response.close();
     close();
@@ skipping 213 matching lines @@
       _notifyServerState("", 0);
       onServerAddressChange(null);
       return this;
     });
   }
 
 }
 
 void _notifyServerState(String ip, int port)
     native "VMServiceIO_NotifyServerState";