Merge pull request #2853 from edx/jsa/credentials-nginx-cors-2

credentials: really fix CORS headers for /static

playbooks/roles/credentials/templates/edx/app/nginx/sites-available/credentials.j2

@@ -15,6 +15,11 @@ upstream credentials_app_server {
 {% endfor %}
 }
 
+map $http_origin $cors_header {
+  default "";
+  '~*^({{ CREDENTIALS_CORS_WHITELIST|join('|')|replace('.', '\.') }})$' "$http_origin";
+}
+
 server {
   server_name {{ CREDENTIALS_HOSTNAME }};
 
@@ -39,11 +44,7 @@ server {
 
   location ~ ^{{ CREDENTIALS_STATIC_URL }}(?P<file>.*) {
     root {{ CREDENTIALS_STATIC_ROOT }};
-
-    if ($http_origin ~* ({{ CREDENTIALS_CORS_WHITELIST|join('|')|replace('.', '\.') }})) {
-      add_header Access-Control-Allow-Origin "$http_origin";
-    }
-
+    add_header Access-Control-Allow-Origin $cors_header always;
     try_files /$file =404;
   }