@Test
void options() {

    when(request.header("Origin")).thenReturn(Optional.empty());
    var controller = new EventController(List.of("*"), null);
    assertThatThrownBy(() -> controller.options(request))
            .isInstanceOf(ForbiddenException.class);
}