func TestCORSFilter_AllowedDomains(t *testing.T) {
	for _, each := range allowedDomainInput {
		tearDown()
		ws := new(WebService)
		ws.Route(ws.PUT("/cors").To(dummy))
		Add(ws)

		cors := CrossOriginResourceSharing{
			AllowedDomains: each.domains,
			CookiesAllowed: true,
			Container:      DefaultContainer}
		Filter(cors.Filter)

		httpRequest, _ := http.NewRequest("PUT", "http://api.his.com/cors", nil)
		httpRequest.Header.Set(HEADER_Origin, each.origin)
		httpWriter := httptest.NewRecorder()
		DefaultContainer.Dispatch(httpWriter, httpRequest)
		actual := httpWriter.Header().Get(HEADER_AccessControlAllowOrigin)
		if actual != each.origin && each.allowed {
			t.Fatal("expected to be accepted")
		}
		if actual == each.origin && !each.allowed {
			t.Fatal("did not expect to be accepted")
		}
	}
}
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.