Bump version to 1.1

* Bumped sleepy version to 1.1
* Added Access-Control-Max-Age header to CORS responses. This facilitates
  client-side caching of preflight responses