r that.

<span><a name="section-7" href="#section-7">7</a>. CORS headers</span>

    All responses MUST carry CORS headers [<a href="#ref-CORS">CORS</a>]. The server MUST also
    reply to OPTIONS requests as per CORS. For GET requests, a wildcard
    origin MAY be returned, but for PUT and DELETE requests, the
    response MUST echo back the Origin header sent by the client.

<span><a name="section-8" href="#section-8">8</a>. Session description</span>

    The information that a client needs to receive in