Add fuller support of CORS headers + doc

Due to some limitations in my understanding of the spec here, I might be
slightly off-base, but for the most part it should work.
For example, should I just catch an OPTIONS request and not send it to
the root URL since I'm returning that I accept everything?
Should I make sure the response content is empty?

Another thing is that for example, https://api.heroku.com doesn't
support OPTIONS (go figure). So the server fails if you do so. I should
probably catch that…
Reformat README to 80 columns