code: public void handleActualRequest(final HttpServletRequest request, final HttpServletResponse response)
  		throws InvalidCORSRequestException, 
  		       CORSOriginDeniedException, 
  		       UnsupportedHTTPMethodException {
  	
  		if (CORSRequestType.detect(request) != CORSRequestType.ACTUAL)
  			throw new InvalidCORSRequestException("Invalid simple/actual CORS request");
  		
  		
  		// Check origin against allow list
  		Origin requestOrigin = new Origin(request.getHeader("Origin"));
  		
  		if (! config.isAllowedOrigin(requestOrigin))
  			throw new CORSOriginDeniedException("CORS origin denied", requestOrigin);
  		
  		
  		// Check method
  		
  		HTTPMethod method = null;
  		
  		try {
  			method = HTTPMethod.valueOf(request.getMethod());
  			
  		} catch (Exception e) {
  			// Parse exception
  			throw new UnsupportedHTTPMethodException("Unsupported HTTP method: " + request.getMethod());
  		}
  		
  		if (! config.isSupportedMethod(method))
  			throw new UnsupportedHTTPMethodException("Unsupported HTTP method", method);
  		
  		
  		// Success, append response headers
  		
  		response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
  		
  		if (config.supportsCredentials)
  			response.addHeader("Access-Control-Allow-Credentials", "true");
  		
  		if (! exposedHeaders.isEmpty())
  			response.addHeader("Access-Control-Expose-Headers", exposedHeaders);
  		
  		
  		// Tag request
  		request.setAttribute("cors.origin", requestOrigin.toString());
  		request.setAttribute("cors.requestType", "actual");
  	}
docs: Handles a simple or actual CORS request.
  
  <p>CORS specification: <a href="http://www.w3.org/TR/access-control/#resource-requests">Simple Cross-Origin Request, Actual Request, and Redirects</a>
  
  @param request  The HTTP request.
  @param response The HTTP response.
  
  @throws InvalidCORSRequestException    If not a valid CORS simple/
  actual request.
  @throws CORSOriginDeniedException      If the origin is not allowed.
  @throws UnsupportedHTTPMethodException If the requested HTTP method
  is not supported by the CORS
  policy.