Update ExporterResource to subclass from BaseResource

This ensures that the default behavior for Serrano resources are
applied such as handling cross-origin resource sharing.
Refine patching of response headers for CORS support

This adds support for Access-Control-Allow-Credentials which is
required for sending cookie data. The -Origin header has been fixed
to echo the origin if allowed for non-safe requests instead of using
the wildcard (*).

The SERRANO_CORS_ORIGIN setting has been deprecated in favor of
SERRANO_CORS_ORIGINS (added an 's' on the end) which is list of supported
origins for CORS. If no origins are defined, all origins are assumed to be
allowed.

Fix #104
Remove truth assertion on origin

This is a remnant from testing in the SERRANO_CORS_ORIGIN string. Now
that the `in` applies to a list, this assertion is no longer needed.
Merge pull request #111 from cbmi/issue-104

Refine patching response headers for CORS support