Overwrite pyramid default exception handling.

Using context=Exception wasn't catching the HTTPNotFound and HTTPForbidden
cases. That's still a mistery why the tests were passing without this change,
however.

This fixes CORS support for 404 and 403.
populate the CHANGES.txt file
Bump version