- CorsMiddleware and CorsOptions (config/cors.php, CORS_ALLOWED_ORIGINS):
  exact origins, subdomain patterns, or any origin; preflights answered
  with 204; headers on every answer to an allowed origin, including
  errors, which it renders through the exception handler; Vary handling
- New projects list it first in app.middleware; it is inactive until an
  origin is allowed
- Psr\Clock\ClockInterface is a symfony/clock NativeClock in app.timezone;
  the application TestCase gains freezeTime()