Fix reversed handling when credentials are allowed

Default case is to not allow credentials, and this was executing the
logic as if the credentials were allowed.
Provide an initialization callback for CORS policies

There are two benefits to this approach:

* A policy can share some information between callbacks.

* The module is guaranteed to be loaded before the optional callbacks
  are ever called.  Previously, erlang:function_exported/3 would fail
  until the module was loaded.