Improve CORS support

This will fix #39 and cleanup a few other things:

* Only treat OPTIONS as preflight if Access-Control-Request-Method  is set
* Only send Access-Control-Allow-Headers for preflight requests
* Don't send a bogus Access-Control-Allow-Headers value

There is a good flowchart at http://www.html5rocks.com/static/images/cors_server_flowchart.png showing how CORS should work on the server end.