title: Cross Origin calls from curl working without needed headers
body: <p>I am invoking one of my APIs using curl as follows(cross origin).</p>
  
  <pre><code>curl -H "Origin: foo.com" -H "Content-Type: application/json" -H "Authorization: Basic YWRtaW46YWRtaW4=" -v https://localhost:9443/api/v10/configs -k
  </code></pre>
  
  <p>I have not set the necessary cross origin headers in the server side. But the API call works. Why is that?</p>
  
  <p>on server side API class, in the options call I am only setting the Allow header.</p>
  
  <pre><code> @OPTIONS
      public Response options() {
          return Response.ok().header(HttpHeaders.ALLOW, "GET").build();
      }
  </code></pre>
  
  <p>The following headers are not set.</p>
  
  <pre><code>Access-Control-Allow-Methods:
  Access-Control-Allow-Origin:
  Access-Control-Allow-Headers:
  </code></pre>