code: func Origin(origin string, dsl func()) {
  	cors := &design.CORSDefinition{Origin: origin}
  
  	if strings.HasPrefix(origin, "/") && strings.HasSuffix(origin, "/") {
  		cors.Regexp = true
  		cors.Origin = strings.Trim(origin, "/")
  	}
  
  	if !dslengine.Execute(dsl, cors) {
  		return
  	}
  	var parent dslengine.Definition
  	switch def := dslengine.CurrentDefinition().(type) {
  	case *design.APIDefinition:
  		parent = def
  		if def.Origins == nil {
  			def.Origins = make(map[string]*design.CORSDefinition)
  		}
  		def.Origins[origin] = cors
  	case *design.ResourceDefinition:
  		parent = def
  		if def.Origins == nil {
  			def.Origins = make(map[string]*design.CORSDefinition)
  		}
  		def.Origins[origin] = cors
  	default:
  		dslengine.IncompatibleDSL()
  		return
  	}
  	cors.Parent = parent
  }
docs: // Origin can be used in: Resource, API
  //
  // Origin defines the CORS policy for a given origin. The origin can use a wildcard prefix
  // such as "https://*.mydomain.com". The special value "*" defines the policy for all origins
  // (in which case there should be only one Origin DSL in the parent resource).
  // The origin can also be a regular expression wrapped into "/".
  // Example:
  //
  //        Origin("http://swagger.goa.design", func() { // Define CORS policy, may be prefixed with "*" wildcard
  //                Headers("X-Shared-Secret")           // One or more authorized headers, use "*" to authorize all
  //                Methods("GET", "POST")               // One or more authorized HTTP methods
  //                Expose("X-Time")                     // One or more headers exposed to clients
  //                MaxAge(600)                          // How long to cache a preflight request response
  //                Credentials()                        // Sets Access-Control-Allow-Credentials header
  //        })
  //
  //        Origin("/(api|swagger)[.]goa[.]design/", func() {}) // Define CORS policy with a regular expression