code: func (wfe *WebFrontEndImpl) setCORSHeaders(response http.ResponseWriter, request *http.Request, allowMethods string) {
  	reqOrigin := request.Header.Get("Origin")
  	if reqOrigin == "" {
  		// This is not a CORS request.
  		return
  	}
  
  	// Allow CORS if the current origin (or "*") is listed as an
  	// allowed origin in config. Otherwise, disallow by returning
  	// without setting any CORS headers.
  	allow := false
  	for _, ao := range wfe.AllowOrigins {
  		if ao == "*" {
  			response.Header().Set("Access-Control-Allow-Origin", "*")
  			allow = true
  			break
  		} else if ao == reqOrigin {
  			response.Header().Set("Vary", "Origin")
  			response.Header().Set("Access-Control-Allow-Origin", ao)
  			allow = true
  			break
  		}
  	}
  	if !allow {
  		return
  	}
  
  	if allowMethods != "" {
  		// For an OPTIONS request: allow all methods handled at this URL.
  		response.Header().Set("Access-Control-Allow-Methods", allowMethods)
  	}
  	response.Header().Set("Access-Control-Expose-Headers", "Link, Replay-Nonce")
  	response.Header().Set("Access-Control-Max-Age", "86400")
  }
docs: // setCORSHeaders() tells the client that CORS is acceptable for this
  // request. If allowMethods == "" the request is assumed to be a CORS
  // actual request and no Access-Control-Allow-Methods header will be
  // sent.