I should know this, but ...
The CORS spec says:
Split the value of the Origin header on the U+0020 SPACE character and
if any of the resulting tokens is not a case-sensitive match for any
of the values in list of origins do not set any additional headers and
terminate this set of steps.
Now, if I'm using JAX-RS to send back the response to one of these,
and the input was multiple origins, does
responseBuilder.header("Origin", "a");
responseBuilder.header("Origin", "b");
create the same sort of space-separated thing, or am I supposed to
glue for myself first?
