Fix options headers

Having been digging through [a](https://github.com/intridea/grape/pull/422) [couple](https://github.com/intridea/grape/issues/406) [issues](https://github.com/intridea/grape/pull/414) I realised I'm not the only one struggling to get Grape to work correctly with CORS.

I've taken a stab at fixing up the `add_head_not_allowed_methods` logic which seems to be passing the test suite still. However looking at some of the discussions surrounding the logic behind this method I'm not sold on it being the 'best' way to do this.

WIP :+1: Feedback appreciated