anchor.diff:  
   | enabled
   | Boolean
  -| Enable HTTP Strict Transport (HSTS)
  +a| .HSTS
  +Enable HTTP Strict Transport
   | false
   
   | includeSubdomains
  
positive.code: {
      "groupId": "io.apiman.plugins",
      "artifactId": "apiman-plugins-cors-policy",
      "version": "1.2.5.Final" <1>
  }
  ```
  <1> Please check for the latest version, this is just an example.
  
  ===== Configuration
  The configuration options available, are:
  
  [cols="2,1,4,1", options="header"]
  |===
  | Option
  
negative.code: 
  | errorOnCorsFailure
  | Boolean
  a| .Error on CORS failure
  When true, any request that fails CORS validation will be terminated with an appropriate error. When false, the request will still be sent to the backend API, but the browser will be left to enforce the CORS failure. In both cases valid CORS headers will be set
  | true
  
  | allowOrigin
  | Set<String>
  | .Access-Control-Allow-Origin
  List of origins permitted to make CORS requests through the gateway. By default same-origin is permitted, and cross-origin is forbidden. An entry of * permits all CORS requests
  | Empty
  
  | allowCredentials
  | Boolean
  a| .Access-Control-Allow-Credentials
  Whether response may be exposed when the `credentials` flag is set to true   on the request
  | false
  
  | exposeHeaders
  | Set<String>
  a| .Access-Control-Expose-Headers
  Which non-simple headers the browser may expose during CORS
  | Empty
  
  | allowHeaders
  | Set<String>
  a| .Access-Control-Allow-Headers
  In response to preflight request, which _headers_ can be used during actual request
  | Empty
  
  | allowMethods
  | Set<String>
  a| .Access-Control-Allow-Methods
  In response to preflight request, which _methods_ can be used during actual request
  | Empty
  
  | maxAge
  | Integer
  a| .Access-Control-Max-Age
  How long preflight request can be cached in delta seconds
  | Not included
  |===
  
  