Add https also as default
Added support for fallback for white listed domains.

This patch addresses a bug we found with our Backbone app. For Backbone
to set the cookie it requires non-wildcard CORS header to be returned,
but we also needed to support wildcard access for other clients.

So this patch adds fallback config parameter that if set allows
returning of explicit origin host for whitelisted domains, but that also
returns '*' header for other domains.

Also required test/unit in tests as tests didn't seem to run before.