According to spec, the getAllResponseHeaders should include trailing CRLF:
https://xhr.spec.whatwg.org/#the-getallresponseheaders()-method

Xdomains implementation does not contain trailing CRLF.
https://github.com/jpillora/xdomain/blob/gh-pages/vendor/xhook.js#L226

This breaks behavior of superagent, which pops the trailing CRLF:
https://github.com/visionmedia/superagent/blob/master/lib

Sorry if this is off-topic, but I love the structure of express-es6-rest-api and I'm struggling to use it with Mongoose. If anyone can point me to an example, that'd be great.

I saw the restful-mongoose link in the README, but that's a bit too automagic to me, I need more control.

The response listener for forced_allow_origin_value is added before the call to checkOrigin. This results in the Access-Control-Allow-Origin header being added regardless of the allow_origin config, which is the opposite of the documented behavior:

Be aware that even if you set forced_allow_origin_value to *,

in https://github.com/lomigmegard/akka-http-cors/blob/master/akka-http-cors/src/main/scala/ch/megard/akka/http/cors/CorsDirectives.scala#L126

Non preflight request is being rejected because it came from an unknown origin

correct behaviour: Non preflight requests from unknown origins should not be rejected

=============================== warnings summary ===============================
tests/unit/test_cors_config.py:33
  .../tests/unit/test_cors_config.py:33: DeprecationWarning: "@coroutine" decorator is deprecated since Python 3.8, use "async def" instead
    def get(self):

tests/integration/test_main.py::test_dummy_setup[pyloop]
  /usr/lib64/python3.8/site-packages/aiohttp/web_server.p