Simplify exposed_headers logic
Return 204 from test handler instead of 200

This is intended to make it possible to more easily determine a
pre-flight response from a response that reached the handler.
Fix the handling differences between simple and pre-flight requests

As a result, one test was changed as we were incorrectly processing
OPTIONS requests without the `Access-Control-Request-Methods` header
as a pre-flight request.

Note that the setting of the `Access-Control-Allow-Origin` and
`Access-Control-Allow-Credentials` in a different order to the spec
doesn't change the final outcome.
Do not forward pre-flight requests to handlers

This request is only used by the client to determine if it is allowed
to send a cross-origin request.  In the case of OPTIONS, then the
client will send a second OPTIONS request that should then be served
by the handler.

In the meantime, the preflight tests for a default policy have been
abandoned because it is unclear whether or not to pass a request to
the handler when the origin does not match.
Merge pull request #5 from danielwhite/fix-preflight-requests

Fix pre-flight request handling