Purely nitpicking here, but since this is a standalone function it would be good to move it below the methods of CORSHandler in the code.