modern browsers support most request methods

per spec, for a XMLHttpRequst they must allow: 
DELETE, GET, HEAD, OPTIONS, POST, PUT

<form> can only do POST&GET

forbidden are:
CONNECT, TRACE, TRACK
add `options` method to route middleware
add middleware for CORS

implementing resource processing per w3c spec
http://www.w3.org/TR/cors/#resource-processing-model

the biggest deficiency is that CORS config applies to the whole app
and currently can not be configured per route ("resource")
Merge branch 'master' of https://github.com/ringo/stick
Merge branch 'master' of https://github.com/ringo/stick
scheduler is global
bump version