@Test void shouldAllowConfiguredOrigin_preflight() throws Exception {
    shouldPermitPreflight(optionsForOrigin("GET", "/api/v2/traces", ALLOWED_ORIGIN));
    shouldPermitPreflight(optionsForOrigin("POST", "/api/v2/spans", ALLOWED_ORIGIN));
  }
Notably, javascript makes pre-flight requests, and won't POST spans if disallowed!
zipkin-server/src/test/java/zipkin2/server/internal/ITZipkinServerCORS.java