@Test void shouldDisallowOrigin() throws Exception {
    shouldDisallowOrigin(getTracesFromOrigin(DISALLOWED_ORIGIN));
    shouldDisallowOrigin(postSpansFromOrigin(DISALLOWED_ORIGIN));
  }
Notably, javascript makes pre-flight requests, and won't POST spans if disallowed!
zipkin-server/src/test/java/zipkin2/server/internal/ITZipkinServerCORS.java