Allow hijacking requests

We should allow hijacking API requests to override the full request (to allow things like caching/etc).

Currently incomplete. While CORS is technically a separate change, it needs the support for OPTIONS, and makes sense to add it now.

Fixes #144.