Improve CORS support

* Only treat OPTIONS as preflight if Access-Control-Request-Method  is set
* Only send Access-Control-Allow-Headers for preflight requests
* Don't send a bogus Access-Control-Allow-Headers value
Merge pull request #40 from tomhughes/cors

Improve CORS support