title: Google Drive webContentLink does not support CORS when file is public
body: <p>The <code>webContentLink</code> is supposed to be a direct link to the file represented by the fileResource.<br>
  Let's first ignore the fact that the link will infact always respond with a 302 pointing to a generated <code>downloadUrl</code> (which has a very finite life-time).  </p>
  
  <p>I understand that the resource pointed to by <code>webContentLink</code> uses cookie-based authentication and CORS would pose a security risk, however the documentation explicitly states that no authentication is needed when the file in question is public (obviously).<br>
  So for the case where the file is publicly available I do not understand why CORS is not supported.  </p>
  
  <p>Is there some security risk associated with this that I fail to realise? Bug? Was it deemed too much work to check the permissions on the file before responding with or without the <code>Access-Control-Allow-Origin</code>.  </p>
  
  <p>On a side note, using a server-side proxy to fetch the <code>downloadUrl</code> pointed to by the 302 location produces a resource that does support CORS.</p>