[CORS] Does the Authorization header qualify as a CORS credential?

Hi guys,

I'm the maintainer of the Java CORS Filter library and I'm trying to
resolve an issue [1] with a developer.

When Access-Control-Allow-Credentials is advertised, does it apply to
the Authorization header (basic HTTP auth, OAuth, etc), or is it limited
to brower cookies only?

Cheers,

Vladimir

[1] https://bitbucket.org/thetransactioncompany/cors-filter/issue/16/

-- 
Vladimir Dzhuvinov <vladimir@dzhuvinov.com>