Splitting TLS and CORS into two separate checks is the most useful part of this. Two small additions for this setup: if the mock echoes the request's Origin back instead of a fixed value, also send "Vary: Origin", so a cache in between can't hand one origin's answer to another. And Access-Control-Max-Age helps while you work, but the browser keeps using the cached preflight until it expires (Chromium caps it at 2 hours, Firefox at 24), so a CORS rule you just changed can look like it didn't apply. Keep the max age short while you're still changing rules.