gistfile1.php

if (isset($_SERVER['HTTP_ORIGIN'])) {
	$origin = $_SERVER['HTTP_ORIGIN'];
	foreach (Configure::read('AccessControlAllowOrigin') as $domain) {
		if (strpos($origin, $domain) !== FALSE) {
			header("Access-Control-Allow-Origin: ".$origin);
			break;
		}
	}
	header("Access-Control-Allow-Credentials: true");
	header("Access-Control-Allow-Methods: POST, GET, OPTIONS");

	if(array_key_exists('HTTP_ACCESS_CONTROL_REQUEST_HEADERS', $_SERVER)) {
		header('Access-Control-Allow-Headers: ' . $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']);
	} else {
		header('Access-Control-Allow-Headers: *');
	}
}