Set Access-Control-Allow-Origin to huggingface.co when a cookie is used for authentication
See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

Currently, we always set `Access-Control-Allow-Origin: *`. It's wrong. When a request passes a cookie, and when the user is authorized to get access thanks to that cookie, we should return: `Access-Control-Allow-Origin: huggingface.co`.

The browser that receives the response will generate a network error (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials).

Fixing this is required to make calls from the browser, for the search feature.
Set Access-Control-Allow-Origin to huggingface.co when a cookie is used for authentication: See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

Currently, we always set `Access-Control-Allow-Origin: *`. It's wrong. When a request passes a cookie, and when the user is authorized to get access thanks to that cookie, we should return: `Access-Control-Allow-Origin: huggingface.co`.

The browser that receives the response will generate a network error (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials).

Fixing this is required to make calls from the browser, for the search feature.