I should know this, but ... The CORS spec says:
Split the value of the Origin header on the U+0020 SPACE character and if any of the resulting tokens is not a case-sensitive match for any of the values in list of origins do not set any additional headers and terminate this set of steps. Now, if I'm using JAX-RS to send back the response to one of these, and the input was multiple origins, does responseBuilder.header("Origin", "a"); responseBuilder.header("Origin", "b"); create the same sort of space-separated thing, or am I supposed to glue for myself first?