code: def _cors_headers(self, environ):
          
          if isinstance(self.cors_allowed_origins, six.string_types):
              if self.cors_allowed_origins == '*':
                  allowed_origins = None
              else:
                  allowed_origins = [self.cors_allowed_origins]
          else:
              allowed_origins = self.cors_allowed_origins
          if allowed_origins is not None and \
                  environ.get('HTTP_ORIGIN', '') not in allowed_origins:
              return []
          if 'HTTP_ORIGIN' in environ:
              headers = [('Access-Control-Allow-Origin', environ['HTTP_ORIGIN'])]
          else:
              headers = [('Access-Control-Allow-Origin', '*')]
          if environ['REQUEST_METHOD'] == 'OPTIONS':
              headers += [('Access-Control-Allow-Methods', 'OPTIONS, GET, POST')]
          if 'HTTP_ACCESS_CONTROL_REQUEST_HEADERS' in environ:
              headers += [('Access-Control-Allow-Headers',
                           environ['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])]
          if self.cors_credentials:
              headers += [('Access-Control-Allow-Credentials', 'true')]
          return headers
docs: Return the cross-origin-resource-sharing headers.