Added remaining CORS headers:

 - Access-Control-Max-Age
 - Access-Control-Allow-Credentials
 - Access-Control-Allow-Methods
 - Access-Control-Allow-Headers
 - Origin
Tests and bug fixes for new CORS headers
Merge pull request #97 from davegurnell/0.6.x

Add extra headers required for CORS