title: Cannot override CORS headers in Slim Framework
body: <p>I am using Slim v3 with the CORS middleware at <a href="https://github.com/tuupola/cors-middleware" rel="nofollow noreferrer">https://github.com/tuupola/cors-middleware</a> to handle CORS headers. Everything works, however I now need to be able to modify the Access-Control-Allow-Origin header based on who a user is logging in as. I have another middleware that executes after the CORS middleware to do user verification, and I was hoping that from within this middleware I could just add $response  = $response->withHeader('Access-Control-Allow-Origin', $userdomain) and it would keep the rest of the CORS headers set by the previous middleware, but override that one. However, this doesn’t seem to happen. No matter where this middleware executes, the CORS headers are always the ones defined by the CORS middleware.</p>
  
  <p>The current setup looks like this:</p>
  
  <pre><code>$app-&gt;add(new \Internal\OAuth\Middleware($this-&gt;getDBs()));
  
  $app-&gt;add(new \Tuupola\Middleware\Cors([
      "origin" =&gt; ['*'],
      "methods" =&gt; ['GET', 'POST', 'PUT', 'OPTIONS', 'DELETE'],
      "headers.allow" =&gt; ['', 'Authorization', 'Content-Type', 'Content-Length', 'Origin', 'Accept'],
      "credentials" =&gt; true,
      "cache" =&gt; 100
  ]));
  </code></pre>
  
  <p>The \Internal\OAuth\Middleware __invoke looks like this:</p>
  
  <pre><code>public function __invoke($req, $res, $next) {
      //do authentication stuff
      $userdomain = 'http://blahblahblah';
      $res = $res-&gt;withHeader('Access-Control-Allow-Origin', $userdomain);
      return $next($req, $res);
  }
  </code></pre>