Shib SP to IDP missing header for CORS

[Cantor, Scott]

I thought this rang a bell, I found [1], which was somebody complaining about the issue, and the upshot was that when I tested various ways of getting the headers set, it always worked, but the specific example that somebody posted to the wiki about doing this for CORS did not for whatever obscure reason.

-- Scott

[1] https://issues.shibboleth.net/jira/browse/SSPCPP-732