Fix OPTIONS headers
CORS support methods
CORS preflight algorithm
CORS request handling
Fix method invocation
Skip CORS request handling after preflight
Fix request-headers parsing
Better preflight vs request handling
Correct expose-headers output
Disable CORS support by default
Rename methods to be consistent with header names
Remove Vary header since its not a general usecase

The `Vary: Origin` is to secure caching if the returned data is
different depending on the host making the request.
Handle CORS request early to discard invalid requests
Refactor CORS handling to have single entrypoint
Fix exception when missing Access-Control-Request-Headers
Set response status on prepare method
Merge branch 'cors' into develop

* cors:
  Set response status on prepare method
  Fix exception when missing Access-Control-Request-Headers
  Refactor CORS handling to have single entrypoint
  Handle CORS request early to discard invalid requests
  Remove Vary header since its not a general usecase
  Rename methods to be consistent with header names
  Disable CORS support by default
  Correct expose-headers output
  Better preflight vs request handling
  Fix request-headers parsing
  Skip CORS request handling after preflight
  Fix method invocation
  CORS request handling
  CORS preflight algorithm
  CORS support methods
  Fix OPTIONS headers