Socket.io + Golang CORS ?

gistfile1.txt

package main

 import (
         "log"         
         "net/http"
         "github.com/googollee/go-socket.io"
 )

 func SayHelloWorld(w http.ResponseWriter, r *http.Request) {
         w.Write([]byte("Hello, World!"))        
 }

 type CrossOriginServer struct {}

 func (s *CrossOriginServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {          
     log.Println(req.Header.Get("Origin"))
     log.Println(req.Method)

     if origin := req.Header.Get("Origin"); origin != "" {
         rw.Header().Set("Access-Control-Allow-Origin", origin)
         rw.Header().Set("Access-Control-Allow-Credentials", "true")
         rw.Header().Set("Access-Control-Allow-Methods", "POST, PUT, PATCH, GET, DELETE, OPTIONS")
         rw.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding")
     }
     if req.Method == "OPTIONS" {
         return
     }   

      server, err := socketio.NewServer(nil)
      if err != nil {
         log.Fatal(err)
      }
     
     server.On("connection", func(so socketio.Socket) {
        log.Println("on connection")
        so.On("disconnection", func() {
            log.Println("on disconnect")
        })
     })

     server.On("error", func(so socketio.Socket, err error) {
        log.Println("error:", err)
     })    

     mux := http.NewServeMux()
     mux.Handle("/socket.io", server)
     mux.HandleFunc("/", SayHelloWorld)   

     mux.ServeHTTP(rw, req)
 }
 ////

 func main() {
   log.Println("listening on :8080")
   http.ListenAndServe(":8080", &CrossOriginServer{})
 }

Client code via browser:

// loaded via CDN: https://cdn.socket.io/socket.io-1.2.1.js
 var socket = io.connect('https://api.domain.com/socket.io');

socket.on('connect', function (data) {
    console.log('connection');
    socket.emit('myevent', { status : 'data' });
});

The code above essentially will DDOS your golang server.. Socket.io client attempts to connect (HTTP GETS) but fails, without error, never connecting nor upgrading.

2015/01/08 14:36:09 http://fiddle.jshell.net
2015/01/08 14:36:09 GET
2015/01/08 14:36:09 http://fiddle.jshell.net
2015/01/08 14:36:09 GET
// [ -- repeats 30+ times per second --]

how do you solve that?