anchor.diff:          async {
               // Manage "preflight" OPTIONS request
               // sent by the browser if the site is https or from another origin.
  -            let isSameAuthority origin =
  -                match Uri.TryCreate(origin, System.UriKind.Absolute) with
  -                | true, origin -> origin.Authority = req.Url.Authority
  -                | false, _ -> false
  -            let origin = req.Headers.["Origin"]
  -            if origin <> null && (isSameAuthority origin || Remoting.allowedOrigins.Contains (origin.ToLowerInvariant())) then
  -                resp.AddHeader("Access-Control-Allow-Origin", origin)
  -                resp.AddHeader("Access-Control-Allow-Credentials", "true")
  -            match req.HttpMethod with
  -            | "OPTIONS" ->
  -                resp.AddHeader("Access-Control-Allow-Headers",
  -                    "x-websharper-rpc, content-type, x-csrftoken")
  -            | _ when Remoting.csrfProtect && not (checkCsrf req resp) ->
  -                resp.StatusCode <- 403
  -                resp.StatusDescription <- "Forbidden"
  -                resp.Write "CSRF"
  -            | _ ->
  +            match corsAndCsrfCheck req.HttpMethod req.Url
  +                    (fun k -> match req.Cookies.[k] with null -> None | c -> Some c.Value)
  +                    (fun k -> match req.Headers.[k] with null -> None | h -> Some h)
  +                    (fun k v -> HttpCookie(k, v, Expires = System.DateTime.UtcNow.AddYears(1000)) |> resp.SetCookie)
  +                    with
  +            | Error (code, descr) ->
  +                resp.StatusCode <- code
  +                resp.StatusDescription <- descr
  +            | Preflight headers ->
  +                headers |> List.iter (fun (k, v) -> resp.AddHeader(k, v))
  +            | Ok headers ->
  +                headers |> List.iter (fun (k, v) -> resp.AddHeader(k, v))
                   let getHeader (x: string) =
                       match req.Headers.[x] with
                       | null -> None
  
positive.code:     let [<Literal>] CsrfTokenKey = "csrftoken"
      let [<Literal>] CsrfTokenHeader = "x-" + CsrfTokenKey
  
  [<Sealed>]
  type RpcHandler() =
  
      let checkCsrf (req: HttpRequestBase) (resp: HttpResponseBase) =
          let cookie = req.Cookies.[RpcUtil.CsrfTokenKey]
          let header = req.Headers.[RpcUtil.CsrfTokenHeader]
          if cookie = null then
              RpcHandler.SetCsrfCookie resp
              false
          else
              header = cookie.Value
  
      let work (ctx: HttpContextBase) =
          let req = ctx.Request
  
negative.code: 
      static member CsrfTokenKey = RpcUtil.CsrfTokenKey
  
      static member MakeCsrfCookie() =
          use rng = new RNGCryptoServiceProvider()
          let bytes = Array.zeroCreate 32
          rng.GetBytes(bytes)
          Convert.ToBase64String bytes
  
      static member SetCsrfCookie (resp: HttpResponseBase) =
          HttpCookie(RpcUtil.CsrfTokenKey, RpcHandler.MakeCsrfCookie(),
              Expires = System.DateTime.UtcNow.AddYears(1000))
          |> resp.SetCookie
  
      static member CorsAndCsrfCheck reqMethod reqUrl getCookie getHeader setInfiniteCookie =
          corsAndCsrfCheck reqMethod reqUrl getCookie getHeader setInfiniteCookie
  
  
  /// The WebSharper RPC HttpModule. Handles RPC requests.
  