Add CORS headers for preflighted requests

CORS headers are now sent for GET and OPTIONS requests.

Access-Control-Allow-Headers is not allowed to be * so just echo the
content of the request header Access-Control-Request-Headers

Should fix issue #45