title: CORS request isn't allowed despite headers being set
body: <p>I get the following error trying to do an XHR request. I've setup CORS response headers, but apparently something is wrong. Can anyone spot the error?</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://domain.dev/path" rel="nofollow">http://domain.dev/path</a>. Origin <a href="http://mobile.dev" rel="nofollow">http://mobile.dev</a> is not allowed by Access-Control-Allow-Origin.</p>
  </blockquote>
  
  <p><strong>Preflight Request Headers (OPTIONS)</strong></p>
  
  <p>This is a pre-flight request, to verify the request.</p>
  
  <pre><code>Accept:*/*
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8
  Access-Control-Request-Headers:origin, x-pre-process, x-requested-with, x-client, x-client-version, accept, x-session
  Access-Control-Request-Method:GET
  Cache-Control:max-age=0
  Connection:keep-alive
  Host:my-app.dev
  Origin:http://mobile.dev
  Pragma:no-cache
  Referer:http://mobile.dev/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/537.2 (KHTML, like Gecko) Chrome/22.0.1211.0 Safari/537.2
  </code></pre>
  
  <p><strong>Response Headers</strong></p>
  
  <p>This is the server response to the pre-flight request.</p>
  
  <pre><code>Access-Control-Allow-Headers:origin, x-pre-process, x-requested-with, x-client, x-client-version, accept, x-session
  Access-Control-Allow-Methods:GET, POST, PUT, PATCH, DELETE
  Access-Control-Allow-Origin:http://mobile.dev
  Access-Control-Max-Age:3600
  Cache-Control:max-age=0, private, must-revalidate
  Connection:close
  Content-Type:text/html; charset=utf-8
  ETag:"7215ee9c7d9dc229d2921a40e899ec5f"
  X-Request-Id:3fca5f24077bcbd1351d552edf311f82
  X-Runtime:0.014551
  </code></pre>
  
  <p><strong>Real Request Header</strong></p>
  
  <p>This is the real request, which is canceled by the browser due to the error quoted above.</p>
  
  <pre><code>Accept:application/json, text/javascript, */*; q=0.01
  Cache-Control:no-cache
  Origin:http://mobile.dev
  Pragma:no-cache
  Referer:http://mobile.dev/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/537.2 (KHTML, like Gecko) Chrome/22.0.1211.0 Safari/537.2
  X-Client:mobile
  X-Client-Version:1.6
  X-Pre-Process:underscore
  X-Requested-With:XMLHttpRequest
  X-Session:j9y01yw33txmdbcz1ao258uy7bzjlm
  </code></pre>