@Test
public void testOptionsUserToken() {

    HttpServletRequest servletRequest = new MockHttpServletRequest();
    HttpServletResponse servletResponse = new MockHttpServletResponse();
    ResourceContext ctx = new RsrcCtxWrapper(servletRequest, servletResponse, null, false, null, new Object(), "apiName");
    zms.optionsUserToken(ctx, "user", "coretech.storage");
    assertEquals("GET", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_METHODS));
    assertEquals("2592000", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_MAX_AGE));
    assertEquals("true", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS));
    
    // using default values where we'll get back null for origin and no allow headers
    
    assertNull(servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN));
    assertNull(servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS));
}