nginx cors with if multiple conditions with http basic auth

gistfile1.nginxconf

location ~* /cache/ {
    proxy_pass                 http://127.0.0.1:8000;

    if ($http_origin ~* "^https?://(dev|admin|www)\.site\.com$" ) {
        set $cors "A";
    }

    if ($request_method = 'OPTIONS') {
        set $cors "${cors}B";
    }

    if ($cors = "AB") {
        add_header Access-Control-Allow-Origin $http_origin always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,WWW-Authorization' always;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }

    if ($cors = "A") {
        add_header Access-Control-Allow-Origin $http_origin always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,WWW-Authorization' always;
    }

    auth_basic                 "Restricted";
    auth_basic_user_file       auth.htpasswd;
}

http://chrisroos.co.uk/blog/2013-03-08-the-behaviour-of-xmlhttprequest-withcredentials-when-used-with-cors

http://www.html5rocks.com/en/tutorials/cors/