diff --git a/src/actual.js b/src/actual.js
new file mode 100644
index 0000000..3fdfa68
--- /dev/null
+++ b/src/actual.js
@@ -0,0 +1,19 @@
+var restify = require('restify');
+
+//
+// For now, delegate to restify.CORS
+//
+// Although there's a few things we could fix
+// around Access-Control-Expose-Headers
+//
+// It would also break the cyclic dependency with Restify :)
+//
+
+exports.handler = function(options) {
+
+  return restify.CORS({
+    origins: options.origins,
+    headers: options.exposeHeaders
+  });
+
+};
diff --git a/src/index.js b/src/index.js
index e9154c7..84fa0d6 100644
--- a/src/index.js
+++ b/src/index.js
@@ -1,6 +1,6 @@
 var util       = require('util');
-var restify    = require('restify');
 var preflight  = require('./preflight');
+var actual     = require('./actual');
 
 module.exports = function(options) {
 
@@ -9,17 +9,8 @@ module.exports = function(options) {
   if (! util.isArray(options.exposeHeaders)) options.exposeHeaders = [];
 
   return {
-
-    actual: restify.CORS({
-      origins: options.origins,
-      headers: options.exposeHeaders
-    }),
-
-    preflight: preflight.handler({
-      origins: options.origins,
-      allowHeaders: options.allowHeaders
-    })
-
+    actual: actual.handler(options),
+    preflight: preflight.handler(options)
   };
 
 };
diff --git a/src/preflight.js b/src/preflight.js
index 765a100..743e037 100644
--- a/src/preflight.js
+++ b/src/preflight.js
@@ -1,6 +1,17 @@
 var restify   = require('restify');
 var origin    = require('./origin');
 
+//
+// For now we use the "default headers" from restify.CORS
+// Maybe this should just be a global setting on this module
+// (ie. list of extra Access-Control-Expose-Headers, regardless of what the middleware config says)
+//
+
+//
+// TODO:
+// Handle the spec better around "simple methods" and "simple headers".
+//
+
 var DEFAULT_ALLOW_HEADERS = restify.CORS.ALLOW_HEADERS;
 var HTTP_NO_CONTENT = 204;