Provide some testing of the CORS headers.

The removed is XXX is because the code is correct, the
problem is a bug in apache:

  https://issues.apache.org/bugzilla/show_bug.cgi?id=51223

As far as I can tell the problem (which has been there since
tiddlyspace.com got AllowOrigin) isn't having significant
impact.
Update docstring on AllowOrigin
add missing required teardown
Refactor ControlView

There's no functional change here, just some method extraction
and moving around of conditionals to chunk things in a more
sensible fashion. It does make it more clear what ControlView
is doing, and how, and may provide some opportunities for
efficiency improvements down the road.

It doesn't, though, make the concept any more sensible.