add CORS tests now that config is dynamic
fix to CORS support; fix OPTIONS preflight handling