Simplify CORS header generation.

There is now only a catch-all OPTIONS route.