cmd/syncthing: Enforce stricter CSRF policy on /rest GET requests (fixes #3134)

GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3137

cmd/syncthing/gui.go

@@ -461,10 +461,6 @@ func corsMiddleware(next http.Handler) http.Handler {
 	//
 	// See https://www.w3.org/TR/cors/ for details.
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Add a generous access-control-allow-origin header since we may be
-		// redirecting REST requests over protocols
-		w.Header().Add("Access-Control-Allow-Origin", "*")
-
 		// Process OPTIONS requests
 		if r.Method == "OPTIONS" {
 			// Only GET/POST Methods are supported