api: roll back utils/http changes and only handle null in coreapi

There's no reason for us to do this wonky behavior outside the store
endpoint, so bring this exceptional behavior just for that case.

src/sentry/coreapi.py

@@ -220,6 +220,8 @@ class ClientApiHelper(object):
         """
         Returns either the Origin or Referer value from the request headers.
         """
+        if request.META.get('HTTP_ORIGIN') == 'null':
+            return 'null'
         return origin_from_request(request)
 
     def project_key_from_auth(self, auth):

src/sentry/utils/http.py

@@ -246,7 +246,5 @@ def origin_from_request(request):
     # Behavior is specified in RFC6454. In either case, we should
     # treat a "null" Origin as a nonexistent one and fallback to Referer.
     if rv in ('', 'null'):
-        referer = request.META.get('HTTP_REFERER')
-        if referer:
-            rv = origin_from_url(referer)
+        rv = origin_from_url(request.META.get('HTTP_REFERER'))
     return rv

src/sentry/web/api.py

@@ -229,7 +229,16 @@ class APIView(BaseView):
             )
 
         if origin:
-            response['Access-Control-Allow-Origin'] = origin
+            if origin == 'null':
+                # If an Origin is `null`, but we got this far, that means
+                # we've gotten past our CORS check for some reason. But the
+                # problem is that we can't return "null" as a valid response
+                # to `Access-Control-Allow-Origin` and we don't have another
+                # value to work with, so just allow '*' since they've gotten
+                # this far.
+                response['Access-Control-Allow-Origin'] = '*'
+            else:
+                response['Access-Control-Allow-Origin'] = origin
 
         return response
 

tests/sentry/utils/http/tests.py

@@ -272,7 +272,7 @@ class OriginFromRequestTestCase(TestCase):
     def test_null_origin(self):
         request = HttpRequest()
         request.META['HTTP_ORIGIN'] = 'null'
-        assert origin_from_request(request) is 'null'
+        assert origin_from_request(request) is None
 
         request.META['HTTP_REFERER'] = 'http://example.com'
         assert origin_from_request(request) == 'http://example.com'