docs: function handleCORS(req, cb) {
      const origin = req.get('origin');
      const trustedDomains = req.client && req.client.trustedDomains;
  
      // Request must have an Origin header
      if (!origin) {
          return cb(null, DISABLE_CORS);
      }
  
      // Origin matches a client_trusted_domain
      if (some(trustedDomains, {trusted_domain: origin})) {
          return cb(null, ENABLE_CORS);
      }
  
      // Origin matches whitelist
      if (getWhitelist().indexOf(url.parse(origin).hostname) > -1) {
          return cb(null, ENABLE_CORS);
      }
  
      return cb(null, DISABLE_CORS);
  }