couchdb cors _show function, put in the shows folder

cors.js

function(head, req){
  return {
    "headers": { 
      "Access-Control-Allow-Origin": "*"
    }
  }
}

rewrites.json

[
  {
    "from": "",
    "to": "_show/cors",
    "method": "OPTIONS"
  }
]

My new idea is you put /db/_security

{ "readers": ["blah"]
, "admins": ["blah"]
, "cors": { "origins": [ "http://some.foreign.origin.com", "http://somecouch.iriscouch.com:5984" ]
             }
}

And couch will support an OPTIONS query for any resource in that database, returning the headers it needs based on the client Origin

your validate_doc_update() can also decide about cross-origin updates, based on req.headers.Origin vs. sec.cors.origins