def PreflightRequest(request, allowOrigins='*', allowMethods=
    'POST, GET, DELETE, OPTIONS', allowHeaders='', allowCredentials=True,
    maxAge=3600, response=None):
    """
    Handles Access-Control preflight requests.

    :param request: The current request.
    :param allowOrigins: Either '*' (all allowed) or a list of hosts e.g ('http://mydomain.com')
    :param allowMethods: 'POST, GET, DELETE, OPTIONS'. Allowed http methods as string.
    :param allowHeaders: Custom headers passed in a request as string.
    :param allowCredentials: True/False. Credentials are made accessible in the client application.
    :param response: The response to be returned. if None `request.response` is used.
    :return: response
    """
    response = response or request.response
    origin = request.headers.get('Origin')
    if origin is None:
        return response
    if allowOrigins != '*':
        if not origin in allowOrigins and not '*' in allowOrigins:
            response.status = '405 Not Allowed'
            return response
    headers = [('Access-Control-Allow-Origin', origin), (
        'Access-Control-Allow-Methods', allowMethods), (
        'Access-Control-Allow-Credentials', str(allowCredentials).lower()),
        ('Access-Control-Max-Age', maxAge), ('Access-Control-Allow-Headers',
        allowHeaders), ('Vary', 'Accept-Encoding, Origin')]
    if hasattr(response, 'headerlist'):
        headers += list(response.headerlist)
    response.headerlist = headers
    return response
