--- a/qmsk/web/json.py	Fri Jan 30 14:05:20 2015 +0200
+++ b/qmsk/web/json.py	Fri Jan 30 14:28:15 2015 +0200
@@ -5,6 +5,8 @@
 
     CORS_ORIGIN = None
     CORS_METHODS = None
+    CORS_HEADERS = None
+    CORS_CREDENTIALS = None
     
     def headers (self):
         if self.CORS_ORIGIN:
@@ -13,6 +15,12 @@
         if self.CORS_METHODS:
             yield 'Access-Control-Allow-Methods', ', '.join(self.CORS_METHODS)
 
+        if self.CORS_HEADERS:
+            yield 'Access-Control-Allow-Headers', ', '.join(self.CORS_HEADERS)
+        
+        if self.CORS_CREDENTIALS:
+            yield 'Access-Control-Allow-Credentials', 'true'
+
     def render_json(self, **parms):
         raise NotImplementedError()