Document CORS handling (was: ISSO_CORS_ORIGIN not working as advertised)

According to the documentation, you can use an ISSO_CORS_ORIGIN environment variable to set e.g. wildcards for the Access-Control-Allow-Origin CORS header. However, it doesn't work in practice, because the code that uses it is as shown in this fragment:

    def func(environ):
        if 'ISSO_CORS_ORIGIN' in environ:
            return environ['ISSO_CORS_ORIGIN']

However, the environ passed into func() is a restricted WSGI environment (request.environ) rather than the full process environment (os.environ). Therefore, the code should use os.environ in the above fragment rather than just environ. Or is there some other way that an ISSO_CORS_ORIGIN OS environment variable is supposed to find its way into a request.environ?

Locate the code containing func(environ) and compare its use of request.environ with the process environment described in the issue. Review the existing CORS documentation and determine whether the intended outcome is a code correction or clearer documentation; done means the documented ISSO_CORS_ORIGIN behavior matches the actual supported configuration.