Improve CORS support

* Only treat OPTIONS as preflight if Access-Control-Request-Method  is set
* Only send Access-Control-Allow-Headers for preflight requests
* Don't send a bogus Access-Control-Allow-Headers value
Yet another attempt to fix the mapnik-config issue (probably not the last...)
Merge pull request #40 from tomhughes/cors

Improve CORS support