Fix CORS, add -Allow-Origin on regular requests.

And fix header parsing, since header values can contain a colon it's not a
good idea to tokenize on them.