@Test
void allowPOSTWithCORS() {

    when(request.header("Origin")).thenReturn(Optional.of("localhost"));
    var controller = new EventController(List.of("*"), null);
    assertThat(controller.options(request).header("Access-Control-Allow-Methods"))
            .hasValueSatisfying(methods -> assertThat(methods).contains("POST"));
}