fix: CORS false-positive in Chrome 71

[lidel]

This PR restores this workaround for localhost API and closes #615. It also adds regression tests.

(Fast tracking as this needs to land in Beta and Stable)

[lidel]

To clarify, our current approach is to remove Origin: null from requests made to API URL by js-ipfs-api running in WebExtension context.

This removes the need for users to add Access-Control-Allow-Origin: null to go-ipfs config, which is better for UX, but remains controversial:

It may seem safe to return Access-Control-Allow-Origin: "null" , but the serialization of the Origin of any resource that uses a non-hierarchical scheme (such as data: or file: ) and sandboxed documents is defined to be "null". Many User Agents will grant such documents access to a response with an Access-Control-Allow-Origin: "null" header, and any origin can create a hostile document with a "null" Origin. The "null" value for the ACAO header should therefore be avoided.

The simple string comparison of CORS as applied to "null" is controversial. Some believe that "null" should be treated as a keyword token indicating the lack of an Origin, which, when tested, should never compare as equal to another "null" Origin. (As is the case with null values in SQL, for example.) It is unwise to build systems which rely on the "null" equals "null" comparison as this behavior may change in the future.

– https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null