@Test
public void cors() throws IOException {

  req.setRequestURI("/does/not/matter");
  req.setMethod("OPTIONS");
  req.addHeader("Access-Control-Request-Method", "DELETE");
  req.addHeader("Access-Control-Request-Headers", "Test-Header");
  req.addHeader("Origin", "http://test.com");
  servlet.service(req, resp);
  assertThat(resp.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
  assertThat(resp.getHeader("Access-Control-Allow-Origin")).isEqualTo("http://test.com");
  assertThat(resp.getHeader("Access-Control-Allow-Headers")).isEqualTo("Test-Header");
  assertThat(resp.getHeader("Access-Control-Max-Age")).isEqualTo("3600");
  assertThat(resp.getHeader("Access-Control-Allow-Credentials")).isEqualTo("true");
  assertThat(COMMA_SPLITTER.split(resp.getHeader("Access-Control-Allow-Methods")))
      .containsExactly("HEAD", "DELETE", "GET", "PATCH", "POST", "PUT");
}