private Response getTracesFromOrigin(String origin) throws IOException {
    return client.newCall(new Request.Builder()
      .url(url(server, "/api/v2/traces"))
      .header("Origin", origin)
      .build()).execute();
  }
Notably, javascript makes pre-flight requests, and won't POST spans if disallowed!
zipkin-server/src/test/java/zipkin2/server/internal/ITZipkinServerCORS.java