cors

curl -H "Origin: https://www.betmenwasdie.xyz" \
> -H "Access-Control-Request-Method: GET" \
> -H "Access-Control-Request-Headers: X-Requested-With" \
> -X OPTIONS --verbose \
> https://www.showmax.com
* Rebuilt URL to: https://www.showmax.com/
*   Trying 148.251.219.27...
* TCP_NODELAY set
* Connected to www.showmax.com (148.251.219.27) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: OU=Domain Control Validated; CN=*.showmax.com
*  start date: Jan 17 12:10:00 2017 GMT
*  expire date: Apr 16 12:10:00 2020 GMT
*  subjectAltName: host "www.showmax.com" matched cert's "*.showmax.com"
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
> OPTIONS / HTTP/1.1
> Host: www.showmax.com
> User-Agent: curl/7.57.0
> Accept: */*
> Origin: https://www.betmenwasdie.xyz
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: X-Requested-With
>
< HTTP/1.1 200 OK
< Date: Mon, 22 Jan 2018 08:34:28 GMT
< Access-Control-Allow-Origin: *
< Content-Type: application/json; charset=utf-8
< Access-Control-Allow-Headers: Accept, Authorization, Content, Content-Type, Origin, SOAPAction, showmax-AB-Tests, showmax-User-Agent
< Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, POST, PUT
< Cache-Control: public, max-age=300
< Content-Length: 2
< Accept-Ranges: bytes
< Server: Showmax-production
< X-Human: If you're reading this, maybe you should be working at Showmax instead. Visit https://tech.showmax.com for more information.
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
<
* Connection #0 to host www.showmax.com left intact