A CORS middleware that gives clients exactly the permissions they ask for, unless constrained by the definitions in options.

Note that applying this middleware to your routes isn't enough for non-GET requests. Pre-flight/OPTIONS routes need to be added manually:

router.options('/your/path', anyCORS(), () => noContent())
router.post('/your/path', anyCORS(), (req, {}) => ok())