CORS middleware

i think this is a solid start to support CORS.

i had to add "options" to the default methods handled by `route` middleware