CORS middleware enhancements

This PR allows the CORS middleware to be completely configurable.
Also: completed the default allowed headers and set OPTIONS cache.