code: function corsHeaders (req, res, next) {
    // Get the default CORS response headers as specified in the Swagger API
    let responseHeaders = getResponseHeaders(req);
  
    // Set each CORS header
    _.each(accessControl, (header) => {
      if (responseHeaders[header] !== undefined) {
        // Set the header to the default value from the Swagger API
        res.set(header, responseHeaders[header]);
      }
      else {
        // Set the header to a sensible default
        switch (header) {
          case accessControl.allowOrigin:
            // By default, allow the origin host. Fallback to wild-card.
            res.set(header, req.get("Origin") || "*");
            break;
  
          case accessControl.allowMethods:
            if (req.swagger && req.swagger.path) {
              // Return the allowed methods for this Swagger path
              res.set(header, util.getAllowedMethods(req.swagger.path));
            }
            else {
              // By default, allow all of the requested methods. Fallback to ALL methods.
              res.set(header, req.get("Access-Control-Request-Method") || swaggerMethods.join(", ").toUpperCase());
            }
            break;
  
          case accessControl.allowHeaders:
            // By default, allow all of the requested headers
            res.set(header, req.get("Access-Control-Request-Headers") || "");
            break;
  
          case accessControl.allowCredentials:
            // By default, allow credentials
            res.set(header, true);
            break;
  
          case accessControl.maxAge:
            // By default, access-control expires immediately.
            res.set(header, 0);
            break;
        }
      }
    });
  
    if (res.get(accessControl.allowOrigin) === "*") {
      // If Access-Control-Allow-Origin is wild-carded, then Access-Control-Allow-Credentials must be false
      res.set("Access-Control-Allow-Credentials", "false");
    }
    else {
      // If Access-Control-Allow-Origin is set (not wild-carded), then "Vary: Origin" must be set
      res.vary("Origin");
    }
  
    next();
  }
docs: Sets the CORS headers.  If default values are specified in the Swagger API, then those values are used.
  Otherwise, sensible defaults are used.