Setting blank string origin in config allows all origins

[kimroen]

If you pass in a blank string to origins in your Rack::Cors-config…

allow do
  origins ''
  ...
end

…you allow all origins access.

The empty string is turned into a regex at lib/rack/cors.rb:264.

Now, this probably wouldn't be typed in like this, but it could end up like this because of some mistake like this:

allow do
  origins /\Amyactualappdomain[01]\.com\z/, APP_CONFIG.some_other_domain
  ...
end

where that config is set to an empty string for whatever reason.

This, combined with the default setting of true for Access-Control-Allow-Credentials (see #126) could potentially be quite dangerous.