Add option to control access control headers

Now you just need to specify options.rest.accessControlAllowOrigin
as the value of the header and successful responses will include
that header
Make accessControlAllowOrigin work for https

We do this by actually writing back to the client
the value of the origin they are requesting in their
http request. This also means that all send200 calls
must now pass in the request, but that's not too bad