function isString(s) {
    return typeof s === 'string' || s instanceof String;
  }
This script is a modified version of the Express 4 CORS module:
https://github.com/expressjs/cors
We're making a modified version because that one leaks headers,
but is otherwise still more full-featured and well-thought-out
than what we were previously using to set headers.

By 'leaks headers', we mean that in certain cases the module
would set headers like `Access-Control-Allow-Origin` or
`Access-Control-Allow-Methods` even if the requesting origin
was not whitelisted.  User agents would still reject the response,
but it would allow attackers to sniff some information about
what the server _would_ allow.

This version of the module _only_ sends headers if the origin
in the request is whitelisted.