CorsFilter.php

<?php
App::uses('DispatcherFilter', 'Routing');

class CorsFilter extends DispatcherFilter {

	public function beforeDispatch(CakeEvent $event) {
		if ($event->data['request']->is('OPTIONS')) {
			$event->stopPropagation();

			$event->data['response']->header(array(
				'Access-Control-Allow-Origin' => '*',
				'Access-Control-Allow-Methods' => 'POST, PUT, DELETE, GET, HEAD',
				'Access-Control-Allow-Headers' => 'Origin, X-Requested-With, Content-Type, Authorization'
			));
			return $event->data['response'];
		}
	}

}