CORS response headers and the preflight answer, gated on AP_ALLOW_ORIGIN.
Unset — the default — this plug is a no-op: no Access-Control-* header on
any response, and OPTIONS falls through to the router's 404 like every
other non-GET method. Set, every response the main listener produces carries
the allow header, including the §5 error envelopes: a page that cannot read
a 422 is a page that can only report "something went wrong".
Why register_before_send
The headers belong on every response, and the responses come from
everywhere — the router's own 404, a 401 halted in
AudioProxy.Plugs.VerifySignature, the 302 a variant HIT redirects with,
the chunked stream AudioProxy.Plugs.RenderAction opens. A callback
registered once at the top of the chain is the only place all of those pass
through; setting the headers here directly would cover the ones that halt
in this plug and nothing else.
Expose-headers, and why it is not empty
The CORS filter hides every response header from a reading page except the
safelisted handful, and the three this API expects a client to act on are
all outside it: Retry-After on the queue-full 429 (without it a page sees
the 429 but not how long to wait), x-audio-proxy for anyone measuring
HIT/MISS, and Accept-Ranges/ETag on a served variant.