@Test
void checkOrigin() {

    var controller = new EventController(List.of("localhost", "example.com"), null);
    controller.checkOrigin("https://localhost");
    controller.checkOrigin("https://api.example.com");
    assertThatThrownBy(() -> controller.checkOrigin("https://example1.com"))
            .isInstanceOf(ForbiddenException.class)
            .hasMessageContaining("access denied");
}