static void shouldPermitPreflight(Response response) {
    assertThat(response.isSuccessful())
      .withFailMessage(response.toString())
      .isTrue();
    assertThat(response.header("vary")).contains("origin");
    assertThat(response.header("access-control-allow-origin")).contains(ALLOWED_ORIGIN);
    assertThat(response.header("access-control-allow-methods"))
      .contains(response.request().header("access-control-request-method"));
    assertThat(response.header("access-control-allow-credentials")).isNull();
    assertThat(response.header("access-control-allow-headers")).contains("content-type");
  }
Notably, javascript makes pre-flight requests, and won't POST spans if disallowed!
zipkin-server/src/test/java/zipkin2/server/internal/ITZipkinServerCORS.java