@Test
public void preflightCheckNegative() {

    String origin = "http://bla.com";
    String headers ="X-Data: Test";
    expect(backend.isOriginAllowed(origin,false)).andReturn(false);
    replay(backend);
    Map<String,String> ret =  handler.handleCorsPreflightRequest(origin, headers);
    assertNull(ret.get("Access-Control-Allow-Origin"));
}