title: CORS error for application running from file:// scheme
body: <p>I have an AngularJS/Cordova app which polls a JSON service on a remote server:</p>
  
  <pre><code>$http({method: 'GET', url: 'http://example.com/index.php'})
  </code></pre>
  
  <p>Developing in the browser and running off my intranet apache server (<code>http://dev</code>) I get "No 'Access-Control-Allow-Origin' header is present" so I fix this by adding:</p>
  
  <pre><code>Header set Access-Control-Allow-Origin "http://dev"
  </code></pre>
  
  <p>All works fine, and I see <code>Origin:http://dev</code> in my Chrome dev tools.</p>
  
  <p>So, having to think about this for the first time, I wonder what the Origin will be when the app runs in the Android/iOS webviews. I decide to do a build and deploy on my devices and expect to see the same error in remote debugging (Safari for iOS and Weinre for Android), but to my surprise it works (without sending any CORS headers)! I also find that in both devices the app runs in the webview under the file:// scheme, rather than (what I assumed) a http server of some sorts provided by the phone OS.</p>
  
  <p>So research seems to suggest that CORS is not required for file:// - such a "site' may access any XHR resource on any domain. But, when I test this on desktop browsers I find that while Safari does not need CORS for file:// but Chrome does, and FireFox works either way without CORS</p>
  
  <p>So my questions:</p>
  
  <p>1) why is my app working without CORS in Android/iOS - is it because CORS does not apply to file://, or, is Cordova doing something to make it work in the device?</p>
  
  <p>I have <code>&lt;access origin="*"/&gt;</code> in my config</p>
  
  <p>2) if, pending answers to Q1, I should want to be on the safe site and explicitly allow requests from apps, what value do you give Access-Control-Allow-Origin for file:// "hosts"? in my debugging there is no Origin header in the requests from file://</p>
  
  <p>3) in addition to blocking the XHR request to the remote server, Chrome is also blocking my app templates (I'm using separate files), see below. Is this a potential issue with my app, or just a Chrome issue that I do not need to worry about? </p>
  
  <pre><code>XMLHttpRequest cannot load file:///Volumes/projects/phonegap/www/templates/tabs.html. Cross origin requests are only supported for HTTP. 
  </code></pre>