title: Proper way to enable CORS on Restler 3 API
body: <p>Restler3 is truly incredible!</p>
  
  <p>We have a "public" API, a "management" API with API_KEY based Access Control, and we would like another API protected by CORS (no API_KEY). </p>
  
  <p>The new CORS protected API would be used to protect all of our javascript ajax calls.  We want to centralize all of the ajax server-side code into one API with consistent entry and exit points.</p>
  
  <p>We have set the following Restler defaults.  </p>
  
  <pre><code>Defaults::$crossOriginResourceSharing = true;
  Defaults::$accessControlAllowOrigin = 'https://www.mydomain.com';
  </code></pre>
  
  <p><strong>Is this the correct technique?</strong></p>
  
  <p><strong>How do we confirm the security is working properly?</strong></p>
  
  <p>For reference, here is the index.php that we have created for this new API.</p>
  
  <pre><code>// get the document root from apache and make sure that there is a trailing slash
  $document_root = rtrim($_SERVER['DOCUMENT_ROOT'], '/') . '/';
  
  // autoload Restler
  // note: this code was provided by Arul to address issues with autoloading Swift and Aws
  $loader = require_once $document_root . 'vendor/autoload.php';
  $loader-&gt;setUseIncludePath(true);
  class_alias('Luracast\\Restler\\Restler', 'Restler');
  
  // import namespaces
  use Luracast\Restler\Defaults;
  use Luracast\Restler\Restler;
  
  // setup versioning
  Defaults::$useUrlBasedVersioning = true;
  
  // setup CORS on this API
  Defaults::$crossOriginResourceSharing = true;
  Defaults::$accessControlAllowOrigin = 'https://www.mydomain.com';
  
  // instantiate restler
  $r = new Restler();
  
  // support both Json and Xml formats
  $r-&gt;setSupportedFormats('JsonFormat', 'XmlFormat');
  
  // api version
  $r-&gt;setAPIVersion(1);
  
  // create resources.json at API Root for use by API Explorer
  $r-&gt;addAPIClass('Luracast\\Restler\\Resources');
  
  // autoload the Diagnostics class in the v1 folder
  $r-&gt;addAPIClass('Diagnostics');
  
  // start
  $r-&gt;handle();
  </code></pre>
  
  <p>Response Headers.</p>
  
  <pre><code>Date: Tue, 15 Oct 2013 17:50:12 GMT
  X-Powered-By: PHP/5.3.27
  Connection: Keep-Alive
  Content-Length: 50
  Server: Apache
  Content-Type: text/html
  Keep-Alive: timeout=5, max=94
  </code></pre>