Better response handling

- In cases where the application may inject a new response in the
  MvcEvent, we can end up with a situation where the response no longer
  has the specified CORS headers -- which leads to invalid responses,
  and the client initiating the CORS request to fail.

  These changes push inflight CORS request detection to the "finish"
  event, which ensures we can inject the headers on the actual response
  object we plan to return to the client.

  Preflight requests are still handled during the "route" event. An
  internal state flag is set in the listener so that the later, inflight
  listener can quit early.
CS fixes

- per php-cs-fixer
Added note to changelog
Merge pull request #16 from weierophinney/hotfix/cors-preflight-normal-segregation

Better response handling