There are various parts that belong to the configuration of your server, meaning here the various initialize and setup routines of your main server class:
* router setup (i.e. which handler will handle which request type)
* CORS support
* responses to OPTIONS requests

If you look at other technologies, they support CORS the same way we do (filter is sometimes called middleware but it's the same thing):
* Node.js:  http://enable-cors.org/server_expressjs.html
* Scala: http://www.scalatra.org/guides/web-services/cors.html

So, I'm still not convinced this should go directly in the router.