code: public CORSHandlerBuilder withAllowedMethods(Method... methods) {
          if (methods == null) {
              allowedMethods = null;
          } else {
              allowedMethods = new HashSet<>(asList(methods));
          }
          return this;
      }
docs: Specifies the headers allowed for CORS requests. Defaults to all methods except Trace and Connect.
  @param methods The methods to allow, or null to allow all except Trace and Connect.
  @return This builder.