Corsrefactor

* make `OPTIONS` requests handle CORS the same way other requests handle it
* fix `Allow-Headers` bug + test