Better response handling

- In cases where the application may inject a new response in the
 MvcEvent, we can end up with a situation where the response no longer
 has the specified CORS headers -- which leads to invalid responses,
 and the client initiating the CORS request to fail.

  These changes push inflight CORS request detection to the "finish"
 event, which ensures we can inject the headers on the actual response
 object we plan to return to the client.

  Preflight requests are still handled during the "route" event. An
 internal state flag is set in the listener so that the later, inflight
 listener can quit early.