title: Can someone provide a CorsPolicy implementation with an explicit Origins list?
body: <h2>Referring to the <a href="http://www.asp.net/signalr/overview/guide-to-the-api/hubs-api-guide-javascript-client#crossdomain" rel="nofollow">SignalR Hubs API Guide</a></h2>
  
  <p>indicates the following information in the configuration comments:</p>
  
  <pre><code>// Setup the CORS middleware to run before SignalR.
  // By default this will allow all origins. You can 
  // configure the set of origins and/or http verbs by
  // providing a cors options with a different policy.
  map.UseCors(CorsOptions.AllowAll);
  </code></pre>
  
  <p>however, the Origins property of System.Web.CorsPolicy has a private setter, no constructor that allows origins to be injected, and no exposed setter method.  With regards to the Origins list, it seems to only expose an "AllowAllOrigins" property and then a useless Origins getter that is only reflecting out the empty List that is constructed during CorsPolicy construction.</p>
  
  <hr>
  
  <p>Of particular note, the default
      app.UseCors(CorsOptions.AllowAll)
  setting is entirely incoherent. By its own tooltip, it is "A policy that allows all headers, all methods, any origin, and supports credentials."</p>
  
  <pre><code>A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true
  </code></pre>
  
  <p>My configuration is currently the "stupid simple" SignalR config</p>
  
  <pre><code>public void Configuration(IAppBuilder app)
  {                
      app.UseCors(CorsOptions.AllowAll);
      app.MapSignalR();
  }
  </code></pre>
  
  <p>Can anyone provide a Microsoft.Owin.Cors.CorsMiddleware example that would reimplement the "AllowAll" Options with an explicit whitelist for Access-Control-Allow-Origin?</p>