code: function setRoutes(allowedOrigin, githubApiProvider, server) {
    server.ajax.on('suggest/v1', (data, end, ask) => {
      // The typical dev and production setups are cross-origin. However, in
      // Heroku deploys and some self-hosted deploys these requests may come from
      // the same host. Chrome does not send an Origin header on same-origin
      // requests, but Firefox does.
      //
      // It would be better to solve this problem using some well-tested
      // middleware.
      const origin = ask.req.headers.origin
      if (origin) {
        let host
        try {
          host = new URL(origin).hostname
        } catch (e) {
          ask.res.setHeader('Access-Control-Allow-Origin', 'null')
          end({ err: 'Disallowed' })
          return
        }
  
        if (host !== ask.req.headers.host) {
          if (allowedOrigin.includes(origin)) {
            ask.res.setHeader('Access-Control-Allow-Origin', origin)
          } else {
            ask.res.setHeader('Access-Control-Allow-Origin', 'null')
            end({ err: 'Disallowed' })
            return
          }
        }
      }
  
      let url
      try {
        url = new URL(data.url)
      } catch (e) {
        end({ err: `${e}` })
        return
      }
  
      findSuggestions(githubApiProvider, url)
        // This interacts with callback code and can't use async/await.
        // eslint-disable-next-line promise/prefer-await-to-then
        .then(suggestions => {
          end({ suggestions })
        })
        .catch(err => {
          end({ suggestions: [], err })
        })
    })
  }
docs: data: {url}, JSON-serializable object. end: function(json), with json of the form: - suggestions: list of objects of the form: - title: string - link: target as a string URL - example: object - pattern: string - namedParams: object - queryParams: object (optional) - link: target as a string URL - preview: object (optional) - style: string