- Standard CORS request (`Origin` set) to whitelisted domain (should succeed)
- CORS pre-flight request (`OPTIONS`) to whitelisted domain (should succeed)
- Standard CORS request (`Origin` set) to non-whitelisted domain (should fail)
- CORS pre-flight request (`OPTIONS`) to non-whitelisted domain (should fail)