add W3C CORS spec and headers - fixes #10
add W3C CSP spec and headers