response.setHeader("Access-Control-Allow-Origin", "*");
if ("options".equals(req.getMethod().toLowerCase())) {
    response.addHeader("Access-Control-Request-Method", "POST");
    response.addHeader("Access-Control-Allow-Headers", "Content-Range, X-Requested-With, Content-Disposition, Content-Type");

    return null;
}