Add CORS headers for preflighted requests

CORS headers are now sent for GET and OPTIONS requests.

Access-Control-Allow-Headers is not allowed to be * so just echo the
content of the request header Access-Control-Request-Headers
Merge pull request #47 from karenc/cors-preflighted-requests-v2

Add CORS headers for preflighted requests