code: @Override
      public ContainerRequest filter(ContainerRequest cr) {
          final DaoManager storage = (DaoManager) servletRequest.getServletContext().getAttribute(DaoManager.class.getName());
          AccountsDao accountsDao = storage.getAccountsDao();
          UserIdentityContext userIdentityContext = new UserIdentityContext(servletRequest, accountsDao);
          // exclude recording file https://telestax.atlassian.net/browse/RESTCOMM-1736
          logger.info("cr.getPath(): " + cr.getPath());
          if (!isUnprotected(cr)) {
              checkAuthenticatedAccount(userIdentityContext);
              filterClosedAccounts(userIdentityContext, cr.getPath());
              //TODO temporarely disable organization domain validation - https://telestax.atlassian.net/browse/BS-408
  //            validateOrganizationAccess(userIdentityContext, storage, cr);
          }
          String scheme = cr.getAuthenticationScheme();
          AccountPrincipal aPrincipal = new AccountPrincipal(userIdentityContext);
          cr.setSecurityContext(new RCSecContext(aPrincipal, scheme));
          return cr;
      }
docs: We return Access-* headers only in case allowedOrigin is present and equals to the 'Origin' header.