Allow customizing cors response headers [fixes #12]

Allows for the following API to customize the CORS response headers:

```
fortune({
  cors: {
    headers: ['X-SignedInAs'/*, ... */],
    methods: ['POST', 'PATCH'],
    origins: ['http://localhost:8000'],
    credentials: false
  }
});
```

Any options left out will default to their current hardcoded values.

The middleware will match the request's Origin header against the list of known origins and pass it back in the Access-Control-Allow-Origin header if it's in the list. If not, it will be rejected.

I did not update the README with this, leaving it up to you however you want to document it.