Moved cross-domain check-request phase.

Moved cross-domain check and hand-off of request to middleware into
`app->before` phase.

This allows CorsServiceProvider to be compatible with other provider
that manipulate the request early in the cycle.

Specifically, it is noes compatible with, fideloper/TrustedProxy
(https://github.com/fideloper/TrustedProxy)