@Test public void validateOrigin_disallowedOrigin() {

  handler = new CorsHandler("http://foobar.com");
  boolean valid = validateOrigin(
    "get",
    ImmutableMap.of("Origin", "http://barbaz.com"),
    ImmutableMap.of("vary", "origin")
  );
  assertThat(valid).isFalse();
}