@Override
    protected void doApply(final ApiRequest request, final IPolicyContext context,
            final CorsConfigBean config, final IPolicyChain<ApiRequest> chain) {
        // Is this request CORS enabled? If not, skip.
        if (CorsConnector.candidateCorsRequest(request)) {
            final CorsConnector corsConnector = new CorsConnector(request, config,
                    context.getComponent(IPolicyFailureFactoryComponent.class));

            // We only need to set the short-circuit connector if it's a pre-flight request.
            if (corsConnector.isShortcircuit()) {
                context.setConnectorInterceptor(new IConnectorInterceptor() {

                    @Override
                    public IApiConnector createConnector() {
                        return corsConnector;
                    }
                });
                chain.doSkip(request);
            } else {
                setResponseHeaders(context, corsConnector.getResponseHeaders());

                if (corsConnector.isFailure()) {
                    chain.doFailure(corsConnector.getFailure());
                } else {
                    chain.doApply(request);
                }
            }
        } else {
            chain.doApply(request);
        }
    }
A policy implementing CORS (Cross-origin resource sharing): a method of defining access to resources
outside of the originating domain. It is principally a security mechanism to prevent the loading of
resources from unexpected domains, for instance via XSS injection attacks.

@see <a href="http://www.w3.org/TR/2014/REC-cors-20140116/">CORS W3C Recommendation 16 January 2014</a>
@see <a href="http://www.w3.org/wiki/CORS">CORS W3 Wiki</a>

@author Marc Savy {@literal <msavy@redhat.com>}
plugins/cors-policy/src/main/java/io/apiman/plugins/cors_policy/CorsPolicy.java