@Test public void handlePreflight_disallowsAuthorization() {

  handler = new CorsHandler("http://foobar.com");
  handlePreflight(
    ImmutableMap.of(
      "Origin", "http://foobar.com",
      "Access-Control-Request-Method", "POST",
      "Access-Control-Request-Headers", "Content-Type, Authorization"),
    ImmutableMap.of(
      "vary", "origin,access-control-request-method,access-control-request-headers"
    )
  );
}