@Test void shouldAllowConfiguredOrigin() throws Exception {
    shouldAllowConfiguredOrigin(getTracesFromOrigin(ALLOWED_ORIGIN));
    shouldAllowConfiguredOrigin(postSpansFromOrigin(ALLOWED_ORIGIN));
  }
Notably, javascript makes pre-flight requests, and won't POST spans if disallowed!
zipkin-server/src/test/java/zipkin2/server/internal/ITZipkinServerCORS.java