Several CORS fixes

* Fix Access-Control-Allow-Methods validation
* Fix Allow header so it returns a comma separated list
* Fix Access-Control-Allow-Methods to echo Allow header because wildcard is not allowed