Allow CORS based on site.allowOriginRegex

Site administrators can configure site.allowOriginRegex to allow web
applications hosted on other sites to make XHR calls to read from
Gerrit's REST API.  This supports creating mashups within an
organization by blessing sibling sites to access Gerrit to read change
data or search results.

Mutation APIs (PUT, POST, DELETE) are currently rejected by not
granting permission to use these methods, nor to send the
X-Gerrit-Auth request header required for XSRF protection.

Change-Id: I90860e619b9d4a3ff9fa2e010cd648a132f56a27

gerrit-acceptance-framework/src/test/java/com/google/gerrit/acceptance/HttpResponse.java

@@ -16,6 +16,7 @@ package com.google.gerrit.acceptance;
 
 import com.google.common.base.Preconditions;
 
+import org.apache.http.Header;
 import org.eclipse.jgit.util.IO;
 import org.eclipse.jgit.util.RawParseUtils;
 
@@ -52,7 +53,12 @@ public class HttpResponse {
   }
 
   public String getContentType() {
-    return response.getFirstHeader("X-FYI-Content-Type").getValue();
+    return getHeader("X-FYI-Content-Type");
+  }
+
+  public String getHeader(String name) {
+    Header hdr = response.getFirstHeader(name);
+    return hdr != null ? hdr.getValue() : null;
   }
 
   public boolean hasContent() {

gerrit-acceptance-framework/src/test/java/com/google/gerrit/acceptance/HttpSession.java

@@ -37,7 +37,11 @@ public class HttpSession {
             account.username, account.httpPassword);
   }
 
-  protected RestResponse execute(Request request) throws IOException {
+  public String url() {
+    return url;
+  }
+
+  public RestResponse execute(Request request) throws IOException {
     return new RestResponse(executor.execute(request).returnResponse());
   }
 }

gerrit-acceptance-framework/src/test/java/com/google/gerrit/acceptance/RestSession.java

@@ -45,7 +45,7 @@ public class RestSession extends HttpSession {
         new BasicHeader(HttpHeaders.ACCEPT, "application/json"));
   }
 
-  private RestResponse getWithHeader(String endPoint, Header header)
+  public RestResponse getWithHeader(String endPoint, Header header)
       throws IOException {
     Request get = Request.Get(url + "/a" + endPoint);
     if (header != null) {