code: private boolean handleInvalidCORS(final HttpRequestHolder request,
                                        final HttpResponseHolder response) {
          String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);
          String method = request.getMethod();
          String accessControlRequestHeaders = request.getHeaders().get(
                  REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
  
          response.getHeaders().put("Content-Type", "text/plain");
  
          //TODO: Rick note that the integration-point implementation still prevents me from decorating the http response code
          //response.code = HttpStatus.SC_FORBIDDEN;
  
          if (log.getLevel() == Level.FINE) {
              // Debug so no need for i18n
              StringBuilder message =
                      new StringBuilder("Invalid CORS request; Origin=");
              message.append(origin);
              message.append(";Method=");
              message.append(method);
              if (accessControlRequestHeaders != null) {
                  message.append(";Access-Control-Request-headers=");
                  message.append(accessControlRequestHeaders);
              }
              log.fine(message.toString());
          }
  
          return false;
      }
docs: Handles a CORS request that violates specification.