docs: protected void handleSimpleCORS(
              final HttpServletRequest request,
              final HttpServletResponse response,
              final FilterChain filterChain)
              throws IOException, ServletException {
  
          CorsFilter.CORSRequestType requestType = checkRequestType(request);
          if (!(requestType == CorsFilter.CORSRequestType.SIMPLE
                  || requestType == CorsFilter.CORSRequestType.ACTUAL)) {
              throw new IllegalArgumentException(
                      "Expects a HttpServletRequest object of type "
                              + CorsFilter.CORSRequestType.SIMPLE
                              + " or "
                              + CorsFilter.CORSRequestType.ACTUAL);
          }
  
          final String originOrNull = request.getHeader(CorsFilter.REQUEST_HEADER_ORIGIN);
          log.debug("Request origin: {}", originOrNull);
          final String origin = originOrNull == null ? "" : originOrNull.toLowerCase(Locale.ENGLISH);
          final String methodOrNull = request.getMethod();
          log.debug("Request method: {}", methodOrNull);
          final String method = methodOrNull == null ? "" : methodOrNull.toUpperCase(Locale.ENGLISH);
  
          // Section 6.1.2
          if (!isOriginAllowed(origin)) {
              handleInvalidCORS(request, response, filterChain);
              return;
          }
  
          if (!allowedHttpMethods.contains(method)) {
              handleInvalidCORS(request, response, filterChain);
              return;
          }
  
          // Section 6.1.3
          // Add a single Access-Control-Allow-Origin header.
          if (anyOriginAllowed && !supportsCredentials) {
              // If resource doesn't support credentials and if any origin is
              // allowed
              // to make CORS request, return header with '*'.
              response.addHeader(CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, "*");
          } else {
              // If the resource supports credentials add a single
              // Access-Control-Allow-Origin header, with the value of the Origin
              // header as value.
              response.addHeader(CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, origin);
          }
  
          // Section 6.1.3
          // If the resource supports credentials, add a single
          // Access-Control-Allow-Credentials header with the case-sensitive
          // string "true" as value.
          if (supportsCredentials) {
              response.addHeader(CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
          }
  
          // Section 6.1.4
          // If the list of exposed headers is not empty add one or more
          // Access-Control-Expose-Headers headers, with as values the header
          // field names given in the list of exposed headers.
          if ((exposedHeaders != null) && (exposedHeaders.size() > 0)) {
              String exposedHeadersString = join(exposedHeaders, ",");
              response.addHeader(
                      CorsFilter.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS, exposedHeadersString);
          }
  
          // Indicate the response depends on the origin
          response.addHeader(CorsFilter.REQUEST_HEADER_VARY, CorsFilter.REQUEST_HEADER_ORIGIN);
  
          // Forward the request down the filter chain.
          filterChain.doFilter(request, response);
      }