docs: function _cors (cookieDomain, publicUrl) {
    return ({ acceptServers, acceptAllOrigins }) => {
      // accept server 2 server requests by default
      acceptServers = acceptServers === undefined ? true : acceptServers
      // do not accept call by outside origins by default
      acceptAllOrigins = acceptAllOrigins === undefined ? false : acceptAllOrigins
      return corsBuilder({
        credentials: true,
        origin (origin, callback) {
          // Case of server to server requests
          if (!origin) {
            if (acceptServers) return callback(null, true)
            return callback(new Error('No CORS allowed for server to server requests'))
          }
  
          // Case where we accept any domain as origin
          if (acceptAllOrigins) return callback(null, true)
  
          const originDomain = new URL(origin).host
  
          // Case of mono-domain acceptance
          if (!cookieDomain) {
            if (originDomain === new URL(publicUrl).host) return callback(null, true)
            return callback(new Error(`No CORS allowed from origin ${origin}`))
          }
  
          // Case of subdomains acceptance
          if (originDomain === cookieDomain || originDomain.endsWith('.' + cookieDomain)) {
            return callback(null, true)
          }
          callback(new Error(`No CORS allowed from origin ${origin}`))
        }
      })
    }
  }