Updating CORS support


- Added headers option to accept custom headers.  I don't see accepting any header to be a security issue.  But if you needed to you could define a list of accepted headers.
- Added methods option to allow xhr requests to any verb.  If you don't define the accepted methods it defaults to only GET.