handle cross-origin cookies with a custom header X-Set-Cookie, fix #24

Cookies set from a different domain can not be read by JS executed in
the current domain. As a workaround, Isso sends both a Set-Cookie and
X-Set-Cookie header. The former is used by the browser to make the
HTTP request to the API, the latter is read by `embed.min.js` to
determine if a comment can be edited or deleted.

When a comment is deleted, the server sends an expired cookies in
Set-Cookie and X-Set-Cookie.
improve request decoding and json parsing
fix endpoint detection when using require.js
add unittest for CORS headers
change license to MIT setup.py
lowercase MiddleWare and fix TypeError in Headers
rename data-prefix to data-isso
Preparing release 0.4
Back to development: 0.5