…equest header, testing it against expected values.

- This commit will be reversed.

…ils to satisfy the CORS configuration, as enabled using the expressjs/cors module, the request will _not_ be rejected by Express. It will simply cause the CORS response header(s) to not be set on the response. As a result, a CORS-compliant browser will raise an error such as the following upon receipt of the response:

"Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8082/v3/entry/gitlab/ihispanic/staticman-test/master/comments. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing)."

"The CORS specification was never designed as a security mechanism to prevent routes from being called; it was only designed as a mechanism to allow a hole to be added to the cross-origin rules of browser user agents."
- expressjs/cors#109 (comment)

In practice...
- Using CORS to restrict the requesting origin would prevent another site from pointing their POST requests at my Staticman instance. But, if the submissions were high-quality, what reason would I have to complain? And low-quality submissions could just as easily come through via my site. Furthermore, those requests would still be processed by Staticman.
- Using CORS to restrict the requesting origin would not prevent a truly malicious actor from submitted POST requests using a tool (e.g., Postman, etc.) that allows for the Origin header to be spoofed.

Restricting POST requests to a Staticman instance, therefore, comes down to use of express-brute, Akismet, captchas, and the like.

…e size of generated comment IDs"

- eduardoboucas#401
- Allow for Nano ID to be used to customize the length and content of generated comment IDs.