code: public Map<String, String> handleCorsPreflightRequest(String pOrigin, String pRequestHeaders) {
          Map<String,String> ret = new HashMap<String, String>();
          if (backendManager.isOriginAllowed(pOrigin,false)) {
              // CORS is allowed, we set exactly the origin in the header, so there are no problems with authentication
              ret.put("Access-Control-Allow-Origin",pOrigin == null || "null".equals(pOrigin) ? "*" : pOrigin);
              if (pRequestHeaders != null) {
                  ret.put("Access-Control-Allow-Headers",pRequestHeaders);
              }
              // Fix for CORS with authentication (#104)
              ret.put("Access-Control-Allow-Credentials","true");
              // Allow for one year. Changes in access.xml are reflected directly in the CORS request itself
              ret.put("Access-Control-Max-Age","" + 3600 * 24 * 365);
          }
          return ret;
      }
docs: Handling an option request which is used for preflight checks before a CORS based browser request is
  sent (for certain circumstances).
  
  See the <a href="http://www.w3.org/TR/cors/">CORS specification</a>
  (section 'preflight checks') for more details.
  
  @param pOrigin the origin to check. If <code>null</code>, no headers are returned
  @param pRequestHeaders extra headers to check against
  @return headers to set