private function _corsConfig(array $env)
    {
        if (!isset($env['auth.cors_config'])) {
            $cors_config = array(
                'origin' => $env['HTTP_ORIGIN'],
                'methods' => 'GET, POST, PUT, DELETE, OPTIONS',
                'allowCredentials' => true,
                'maxAge' => 86400,
                'allowHeaders' => 'X-Requested-With'
            );

            if (isset($env['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) {
                $cors_config['methods'] = $env['HTTP_ACCESS_CONTROL_REQUEST_METHOD'];
            }

            if (isset($env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) {
                $cors_config['allowHeaders'] = $env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'];
            }

        } else {
            $cors_config = $env['auth.cors_config'];
        }

        return $cors_config;
    }