added do_OPTIONS, fixed CORS

Trying to access sleepy.mongoose (started with the `--xorigin` flag) from JavaScript with CORS on Chrome and Safari, I always got `501 Unsupported method ('OPTIONS')`. So I implemented it, works fine now.