@Test
    public void shouldFailWithDisallowedMethods() {
        allowOrigins.add("bede");
        config.getAllowMethods().add("GET, HEAD");

        setOrigin("bede");
        setHost("venerable");

        setRequestMethods(new String[] { "DELETE" });

        connector = new CorsConnector(request, config, failureFactory);
        HeaderMap responseHeaders = connector.getResponseHeaders();

        Assert.assertTrue(connector.isFailure());
        Assert.assertEquals(400, connector.getFailure().getResponseCode());
        Assert.assertTrue(!connector.isShortcircuit());
        Assert.assertEquals("bede", responseHeaders.get(CorsConnector.AC_ALLOW_ORIGIN_KEY));
        // Must still list allowed methods
        Assert.assertEquals("GET, HEAD", responseHeaders.get(CorsConnector.AC_ALLOW_METHODS_KEY));
    }
Test preflight aspects of CORS

@author Marc Savy {@literal <msavy@redhat.com>}
plugins/cors-policy/src/test/java/io/apiman/plugins/cors_policy/CorsConnectorPreflightTest.java