title: CORS not working in php slim framework
body: <p>I have created rest api using php slim framework.
  Here is my code</p>
  
  <pre><code>&lt;?php
  require 'Slim/Slim.php';
  require '../lib/cors_enable.php';
  require '../lib/logger.php';
  require '../../db_config/config.php';
  require '../lib/predis-0.8/lib/Predis/Autoloader.php';
  Predis\Autoloader::register();
  require '../lib/RedisMethods.php';
  require '../lib/APICaller.php';
  require '../lib/FosterGemOAuth.php';
  require '../lib/FosterGemUser.php';
  require '../lib/NewsFeed.php';
  require '../lib/FosterGemBookmarks.php';
  require '../lib/TopicWebsite.php';
  require '../lib/FetchFullArticle.php';
  require '../lib/PushNotification.php';
  
  
  \Slim\Slim::registerAutoloader();
  $app = new \Slim\Slim();
  
  if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
      // return only the headers and not the content
      // only allow CORS if we're doing a GET - i.e. no saving for now.
      if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) {
          if($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] == 'GET' || $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] == 'POST') {
              header('Access-Control-Allow-Origin: *');
              header('Access-Control-Allow-Headers: X-Requested-With, X-authentication,Content-Type, X-client');
          }
      }
      exit;
  }
  
  
  $app-&gt;post('/messagebhej(/)(:profile_id/?)(:app_auth_token/?)', 'messagebhej');
  $app-&gt;post('/login','login');
  
  
  $app-&gt;run();
  
  function messagebhej($profile_id, $app_auth_token){
      $error='';
      $request = file_get_contents('php://input');
      try {
          $request_data = json_decode($request,true);
          if($app_auth_token == APP_AUTH_TOKEN){
              $obj = new PushNotification();
              $res = $obj-&gt;sendMessage($profile_id, $request_data);
          } else {
              $error='Access Denied';
          }
      } catch (Exception $ex) {
          $error=$ex-&gt;getMessage();
          log_error($error,"index.php | sendMessage function");
      }
      if($error) {
          $return_data= '{"Status":"Failed","Message":"'.$error.'"}';
      } else {
          $return_data='{"Status":"Success"}';
      }
      echo $return_data;
  }
  
  function login() {
      $error='';
      $request = file_get_contents('php://input');
     try {
      $request_data = json_decode($request,true);
      if(isset($request_data['EmailAddress']) &amp;&amp; isset($request_data['Password'])){
          if($request_data['EmailAddress']){
              $obj = new FosterGemUser();
              $user_data = $obj-&gt;get_user($request_data['EmailAddress'],$request_data['Password'],$request);
          } else {
              $error='Please enter your email address.';
          }      
      } else {
          $error='Wrong Data Format.';
      }
     }  catch (Exception $ex) {
              $error=$ex-&gt;getMessage();
              log_error($error,"index.php | login function");
      }
          if($error) {
              $return_data= '{"Status":"Error","Message":"'.$error.'"}';
          } else {
             $return_data=$user_data;
          }
     echo $return_data;
  }
  </code></pre>
  
  <p>Now both the api works fine when I call it using Rest client. However when I call login api from javascript it works well but messagebhej api gives error </p>
  
  <pre><code>XMLHttpRequest cannot load http://api.fostergem.com/messagebhej/556714b04ec0a40d3cda0118/{app_auth_token}. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:63343' is therefore not allowed access. The response had HTTP status code 404.
  </code></pre>
  
  <p>I am getting crazy. Everything is is same then how the cors is enabled for one api and not for other. </p>
  
  <p>Here is my cors_enable.php</p>
  
  <pre><code>&lt;?php
  
  // Specify domains from which requests are allowed
  header('Access-Control-Allow-Origin: *');
  
  // Specify which request methods are allowed
  header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
  
  // Additional headers which may be sent along with the CORS request
  // The X-Requested-With header allows jQuery requests to go through
  header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');
  
  // Set the age to 1 day to improve speed/caching.
  header('Access-Control-Max-Age: 86400');
  
   ?&gt;
  </code></pre>