anchor.diff:      {_, Origin} = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
       {_, <<"x-exposed">>} = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers),
       {_, <<"true">>} = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers).
  +
  +preflight_no_method(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([{<<"Origin">>, Origin}], Config),
  +    false = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +preflight_method(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([{<<"Origin">>, Origin}, {<<"Access-Control-Request-Method">>, <<"DELETE">>}], Config),
  +    false = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +preflight_allowed_method(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([{<<"Origin">>, Origin}, {<<"Access-Control-Request-Method">>, <<"PUT">>}], Config),
  +    {_, Origin} = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    {_, <<"PUT">>} = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +preflight_credentials(Config) ->
  +    Origin = <<"http://credentials.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([{<<"Origin">>, Origin}, {<<"Access-Control-Request-Method">>, <<"PUT">>}], Config),
  +    {_, Origin} = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    {_, <<"PUT">>} = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    {_, <<"true">>} = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +preflight_header(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([
  +                   {<<"Origin">>, Origin},
  +                   {<<"Access-Control-Request-Method">>, <<"PUT">>},
  +                   {<<"Access-Control-Request-Headers">>, <<"X-Custom">>}
  +                  ], Config),
  +    false = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-headers">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +preflight_allowed_header(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([
  +                   {<<"Origin">>, Origin},
  +                   {<<"Access-Control-Request-Method">>, <<"PUT">>},
  +                   {<<"Access-Control-Request-Headers">>, <<"X-Requested">>}
  +                  ], Config),
  +    {_, Origin} = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    {_, <<"PUT">>} = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    {_, <<"X-Requested">>} = lists:keyfind(<<"access-control-allow-headers">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  +
  +%% Test for Webkit browsers requesting 'Origin' header.
  +preflight_allowed_header_webkit(Config) ->
  +    Origin = <<"http://allowed.example.com">>,
  +    {ok, 200, Headers, _} =
  +        preflight([
  +                   {<<"Origin">>, Origin},
  +                   {<<"Access-Control-Request-Method">>, <<"PUT">>},
  +                   {<<"Access-Control-Request-Headers">>, <<"origin, x-requested">>}
  +                  ], Config),
  +    {_, Origin} = lists:keyfind(<<"access-control-allow-origin">>, 1, Headers),
  +    {_, <<"PUT">>} = lists:keyfind(<<"access-control-allow-methods">>, 1, Headers),
  +    {_, <<"origin, x-requested">>} = lists:keyfind(<<"access-control-allow-headers">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-allow-credentials">>, 1, Headers),
  +    false = lists:keyfind(<<"access-control-expose-headers">>, 1, Headers).
  
positive.code: groups() ->
      [
       {default, [parallel], [
                              simple_no_origin_get,
                              simple_get
                             ]},
       {policy, [parallel], [
                             simple_no_origin_get,
                             simple_get,
                             simple_allowed_get,
                             simple_allowed_credentials_get
                            ]}
      ].
  
  
negative.code: -export([end_per_group/2]).
  
  %% tests
  -export([standard_no_origin_get/1]).
  -export([standard_no_origin_options/1]).
  -export([standard_get/1]).
  -export([standard_options/1]).
  -export([simple_allowed_get/1]).
  -export([simple_allowed_credentials_get/1]).
  -export([preflight_method/1]).
  -export([preflight_no_method/1]).
  -export([preflight_allowed_method/1]).
  -export([preflight_credentials/1]).
  -export([preflight_header/1]).
  -export([preflight_allowed_header/1]).
  -export([preflight_allowed_header_webkit/1]).
  
  all() ->
      [
  