use Flask's config system
add CORS tests now that config is dynamic
fix to CORS support; fix OPTIONS preflight handling