Improve CORS support

* Only treat OPTIONS as preflight if Access-Control-Request-Method  is set
* Only send Access-Control-Allow-Headers for preflight requests
* Don't send a bogus Access-Control-Allow-Headers value