code: public function handle(ServerRequestInterface $request, ServerFrame $frame) : ResponseInterface
      {
          // we need to set the request so it can be injected into the controllers and everything that depends on the request
          $this->mvcRequestHolder->setRequest(new Request($request));
  
          // Match the route ///////////////////////////////////////////////////////////////////////////////////////////
          try {
              if ($this->stopWatch) {
                  $this->stopWatch->start('routing');
              }
  
              $invoker = $this->mvcRouting->match($request);
  
              if ($this->stopWatch) {
                  $this->stopWatch->stop('routing');
              }
  
          } catch (RouteNotFoundException $e) {
              throw new HttpNotFound($e);
          }
  
          // Check for authorization ///////////////////////////////////////////////////////////////////////////////////
          if ($this->stopWatch) {
              $this->stopWatch->start('auth');
          }
  
          $canAccess = $this->accessDecisionMaker->decide($invoker);
  
          if ($this->stopWatch) {
              $this->stopWatch->stop('auth');
          }
  
          if (false === $canAccess) {
              // forward to login page
              throw new HttpUnauthorized();
          }
  
          // call controller ///////////////////////////////////////////////////////////////////////////////////////////
          if ($this->stopWatch) {
              $this->stopWatch->start('controller');
          }
  
          // TODO: this is ugly ... we need to acquire the controller instance differently
          $result = $invoker->invoke($this->container);
  
          if ($this->stopWatch) {
              $this->stopWatch->stop('controller');
          }
  
          // Is this a redirect ?
          if ($result instanceof Redirect) {
              return $frame->responseFactory()->create($result->getStatusCode())->withHeader('Location', $result->getUrl());
          }
  
          // render view /////////////////////////////////////////////////////////////////////////////////////////////////////////////
          $rendered = $this->resultConverterRegistry->apply($invoker, $result);
  
          $response = $frame->responseFactory()->create(200, ['Content-Type' => $invoker->getRoute()->getContentType()], $rendered);
  
          ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
          // TODO: how do we do the cors injection for real ?
          $response = $response->withHeader('Access-Control-Allow-Origin', '*');
          ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  
  //        var_dump($response->getHeaders()); die();
  
          return $response;
      }
docs: @param ServerRequestInterface $request
  @param ServerFrame            $frame
  
  @return ResponseInterface