Moved CORS into the application, added spec.
Added spec for OPTIONS.