title: sailsjs cors bad request still getting through to controller
body: <p>So my cors.js file looks like</p>
  
  <pre><code>module.exports.cors = {
    allRoutes: true,
    origin: require('./local.js').hosts, // this is 'http://localhost'
  }
  </code></pre>
  
  <p>I then chose a random site to make a request from, in this case: <a href="http://tools.pingdom.com/fpt/" rel="nofollow noreferrer">http://tools.pingdom.com/fpt/</a></p>
  
  <p>Here is my request and response from the page</p>
  
  <blockquote>
    <p>$.post('<a href="http://localhost:1337/gift/create" rel="nofollow noreferrer">http://localhost:1337/gift/create</a>') Object {readyState: 1,
    getResponseHeader: function, getAllResponseHeaders: function,
    setRequestHeader: function, overrideMimeType: function…}
    jquery-2.1.1.min.js:4 POST <a href="http://localhost:1337/gift/create" rel="nofollow noreferrer">http://localhost:1337/gift/create</a> 
    (index):1 XMLHttpRequest cannot load
    <a href="http://localhost:1337/gift/create" rel="nofollow noreferrer">http://localhost:1337/gift/create</a>. The 'Access-Control-Allow-Origin'
    header contains the invalid value ''. Origin
    '<a href="http://tools.pingdom.com" rel="nofollow noreferrer">http://tools.pingdom.com</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>However, I'm still getting errors in the console as the controller function still gets called.</p>
  
  <pre><code>sails&gt; error: Sending 500 ("Server Error") response: 
  TypeError: Cannot read property 'email' of undefined
  </code></pre>
  
  <p>I would think that cors should just end the connection if it fails.</p>
  
  <p>Am I missing a setting?</p>
  
  <p>This is a duplicate of this post <a href="https://stackoverflow.com/questions/17355020/cors-preflight-passes-main-request-completes-w-200-but-browser-still-has-orig">CORS: preflight passes, main request completes w/200, but browser still has Origin error</a> but it does not seem like it was resolved.  Do we know why the post continues to go through?</p>
  
  <p>Here is the response header</p>
  
  <pre><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Origin:
  Connection:keep-alive
  Content-Length:2
  Content-Type:application/json; charset=utf-8
  Date:Wed, 28 Jan 2015 15:56:51 GMT
  Set-Cookie:sails.sid=s%3A5TJr82PCN-Tas2GrfKkhooEB.IWwc75iQUPRYoR7qWSep6xc%2BSLUkOV0IQe0w63GDYrQ; Path=/; HttpOnly
  X-Powered-By:Sails &lt;sailsjs.org&gt;
  </code></pre>
  
  <p>There is not access-control-allow-origin set. I can make a policy for that, but is this is bug in Sails?</p>