So if the webpage opened with the file:// url protocol in PhoneGap was to send the header "Access-Control-Allow-Origin: *" -- theoretically it should all work with socket.io?
(it's possible to do so through NSURLProtocol, but I didn't want to go down this rabbit hole without knowing the fix)