code: @Nullable
      public CorsPolicy getPolicy(String origin, PathMappingContext pathMappingContext) {
          requireNonNull(origin, "origin");
          if (isAnyOriginSupported()) {
              return Iterables.getFirst(policies, null);
          }
          final String lowerCaseOrigin = Ascii.toLowerCase(origin);
          final boolean isNullOrigin = CorsService.NULL_ORIGIN.equals(lowerCaseOrigin);
          for (final CorsPolicy policy : policies) {
              if (isNullOrigin && policy.isNullOriginAllowed() &&
                  isPathMatched(policy, pathMappingContext)) {
                  return policy;
              } else if (!isNullOrigin && policy.origins().contains(lowerCaseOrigin) &&
                         isPathMatched(policy, pathMappingContext)) {
                  return policy;
              }
          }
          return null;
      }
docs: Returns the policy for the specified {@code origin}.
  
  @return {@link CorsPolicy} which allows the {@code origin},
  {@code null} if the {@code origin} is not allowed in any policy.