cors policy on pantheon in mu-plugin

cors-playground.php

<?php
/*
  Plugin Name: cors policy to allow playground
  Plugin URI: icodeforapurpose.com
  Description: Cors policy to allow playground to fetch the nightly gutenberg.zip.
  Version: 0.1
  Author: Birgit Pauli-Haack
  Author URI: gutenbergtimes.com
*/

function dynamic_cors_headers( $headers ) {
	// Caching varies based on the origin of requests
	$headers['Vary'] = 'Origin';
	// If no origin is supplied, no further checks are needed
	if ( ! array_key_exists( 'HTTP_ORIGIN', $_SERVER ) ) {
		return $headers;
	}
	// Each of the domains in this array will be given an allow header
	// Note that http or https and the www subdomain are each different origins
	$allowed_domains = array(
		'https://playground.wordpress.net'
	);
	if ( in_array( $_SERVER['HTTP_ORIGIN'], $allowed_domains ) ) {
		$headers['Access-Control-Allow-Origin'] = $_SERVER['HTTP_ORIGIN'];
	}
	return $headers;
}
add_filter( 'wp_headers', 'dynamic_cors_headers' );

echo "<script>console.log( 'CORS Debug Objects: " . $output . "' );</script>"
?>