Do not abort cross-origin requests with an empty 200 (#1955)

[svpernova09]

How to reproduce

$ tests/server start
$ git checkout master

$ curl -s -o /dev/null -w '%{http_code} %{size_download}\n' \
-H 'Origin: https://example.com' http://localhost:8080/
200 0

$ curl -s -o /dev/null -w '%{http_code} %{size_download}\n' \
http://localhost:8080/
200 53385

Same URL, same server. One request-header a client fully controls turns the page into a zero-byte 200 OK.

exit(10) at include/prepend.inc:31 sets a process exit status and emits no body, so the response is a perfectly
valid success with nothing in it.

That empty body then gets cached and served to everyone: Origin is not part of the CDN cache key and we send no Vary
header. It also persists, because Cache-Control: public, max-age=300 is set later in include/header.inc:54 and never
runs, so the CDN applies its own default TTL instead of five minutes.

On this branch:

$ git checkout prevent-returning-blank-responses

$ curl -s -o /dev/null -w '%{http_code} %{size_download}\n' \
-H 'Origin: https://example.com' http://localhost:8080/
200 53385

[derickr]

I don't understand why you're allowing these three methods without the CORS origin server to match.