code: func (c *Cors) handleActualRequest(w http.ResponseWriter, r *http.Request) {
  	headers := w.Header()
  	origin := r.Header.Get("Origin")
  
  	if r.Method == "OPTIONS" {
  		c.logf("Actual request no headers added: method == %s", r.Method)
  		return
  	}
  	// Always set Vary, see https://github.com/rs/cors/issues/10
  	headers.Add("Vary", "Origin")
  	if origin == "" {
  		c.logf("Actual request no headers added: missing origin")
  		return
  	}
  	if !c.isOriginAllowed(r, origin) {
  		c.logf("Actual request no headers added: origin '%s' not allowed", origin)
  		return
  	}
  
  	// Note that spec does define a way to specifically disallow a simple method like GET or
  	// POST. Access-Control-Allow-Methods is only used for pre-flight requests and the
  	// spec doesn't instruct to check the allowed methods for simple cross-origin requests.
  	// We think it's a nice feature to be able to have control on those methods though.
  	if !c.isMethodAllowed(r.Method) {
  		if c.log != nil {
  			c.logf("Actual request no headers added: method '%s' not allowed",
  				r.Method)
  		}
  
  		return
  	}
  	headers.Set("Access-Control-Allow-Origin", origin)
  	if len(c.exposedHeaders) > 0 {
  		headers.Set("Access-Control-Expose-Headers", strings.Join(c.exposedHeaders, ", "))
  	}
  	if c.allowCredentials {
  		headers.Set("Access-Control-Allow-Credentials", "true")
  	}
  	c.logf("Actual response added headers: %v", headers)
  }
docs: // handleActualRequest handles simple cross-origin requests, actual request or redirects