code: public final boolean isAllowedSubdomainOrigin(final Origin origin) {
  		
  		try {
  			ValidatedOrigin validatedOrigin = origin.validate();
  			
  			String scheme = validatedOrigin.getScheme();
  			String suffix = validatedOrigin.getSuffix();
  			
  			for (ValidatedOrigin allowedOrigin: allowedOrigins) {
  				
  				if (suffix.endsWith("." + allowedOrigin.getSuffix()) && 
  				    scheme.equalsIgnoreCase(allowedOrigin.getScheme()))
  
  					return true;
  			}
  			
  		} catch (OriginException e) {
      			
  			return false;
  		}
  		
  		return false;
  	}
docs: Helper method to check whether the specified origin is a subdomain
  origin of the {@link #allowedOrigins}. This is done by looking up the
  origin's scheme, hostname and port and matching them with each of the
  {@link #allowedOrigins}.
  
  <p>Example:
  
  <p>{@code Origin: https://foo.example.com } matches
  {@code cors.allowedOrigin = https://example.com } whereas
  {@code cors.allowedOrigin = http://example.com } would not match.
  
  @param origin The origin as reported by the web client (browser),
  {@code null} if unknown.
  
  @return {@code true} if the origin is an allowed subdomain origin,
  else {@code false}.