code: public CORSConfigBuilder withAllowedOrigins(Collection<String> allowedOrigins) {
          if (allowedOrigins != null) {
              for (String allowedOrigin : allowedOrigins) {
                  if (!allowedOrigin.startsWith("http://") && !allowedOrigin.startsWith("https://")) {
                      throw new IllegalArgumentException(allowedOrigin + " is invalid: origins much have an http:// or https:// prefix");
                  }
                  if (allowedOrigin.lastIndexOf('/') > 8) {
                      throw new IllegalArgumentException(allowedOrigin + " is invalid: origins should not have any paths. Example origin: https://example.org");
                  }
              }
          }
          this.allowedOrigins = allowedOrigins;
          return this;
      }
docs: The origin values that CORS requests are allowed for, or null to allow all origins.
  @param allowedOrigins Allowed origins, such as <code>https://example.org</code> or <code>http://localhost:8080</code>
  @return This builder