   ## Note that this still requires Coauthor authentication via cookies.
   'Access-Control-Allow-Origin': req.headers['origin'] ? '*'
   'Access-Control-Allow-Credentials': 'true'
+  'Vary': 'Origin'
 
 ## Mimicking vsivsi:file-collection http_access_server.coffee
 WebApp.rawConnectHandlers.use '/file',

          $elemMatch:
            hashedToken: Accounts?._hashLoginToken authToken
      unless user?
        res.writeHead 400
        return res.end "Invalid X-Auth-Token #{authToken}"
      username = "User '#{user.username}'"
    else
      ## Allow null user, and check below for anonymous access.
      user = null
      username = "Not-logged-in user"
      #res.writeHead 400
      #return res.end "Missing X-Auth-Token header/token"

    ## Map message -> file

    # Debatable whether that would be a bug or feature.
    #unless messageRoleCheck(msg.group, msg, 'read', user) and (msg.group == req.gridFS.metadata.group or groupRoleCheck req.gridFS.metadata.group, 'read', user)
    unless canSee msg, false, user
      res.writeHead accessError, accessHeaders req
      return res.end "#{username} lacks read permissions for group of message/file #{msgId}"

    ## get()
    headers = Object.assign accessHeaders(req),
      'Content-Type': 'text/plain'
    if req.headers['if-modified-since']
      since = Date.parse req.headers['if-modified-since']  ## NaN if invaild
