'Allow CORS requests if configured to do so by echoing back the request\'s
\'Origin\' header (if any) as the response header \'Access-Control-Allow-Origin\''

def set_cors_headers(self):

    if (not self.app.config.get('allowed_origin_hostnames', None)):
        return
    origin_header = self.request.headers.get('Origin', None)
    if (not origin_header):
        return
    def matches_allowed_origin(origin, allowed_origin):
        if isinstance(allowed_origin, string_types):
            return (origin == allowed_origin)
        match = allowed_origin.match(origin)
        return (match and (match.group() == origin))
    def is_allowed_origin(origin):
        if (not origin):
            return False
        for allowed_origin in self.app.config.allowed_origin_hostnames:
            if ((allowed_origin == '*') or matches_allowed_origin(origin, allowed_origin)):
                return True
        return False
    origin = urlparse.urlparse(origin_header).hostname
    if is_allowed_origin(origin):
        self.response.headers['Access-Control-Allow-Origin'] = origin_header
