feat: passthrough cors middleware if pre-existing headers are present

Resolves #447

lib/helpers/initialize_app.js

@@ -1,7 +1,6 @@
 const assert = require('assert');
 const querystring = require('querystring');
 
-const cors = require('@koa/cors');
 
 const Router = require('../router');
 const { homepage, version } = require('../../package.json');
@@ -10,6 +9,7 @@ const {
   getIntrospection, discovery, checkSession, endSession, codeVerification,
 } = require('../actions');
 const getInteraction = require('../actions/interaction');
+const cors = require('../shared/cors');
 const grants = require('../actions/grants');
 const responseModes = require('../response_modes');
 const error = require('../shared/error_handler');

lib/shared/cors.js

@@ -0,0 +1,15 @@
+const cors = require('@koa/cors');
+
+module.exports = (opts) => {
+  const builtin = cors(opts);
+
+  return (ctx, next) => {
+    const headers = Object.keys(ctx.response.headers);
+
+    if (headers.find(x => x.toLowerCase().startsWith('access-control-'))) {
+      return next();
+    }
+
+    return builtin(ctx, next);
+  };
+};