Valued param: add option fill

When fill is set to true and the parameter is not present
in the input, it is created with the default value.
Support for HTTP access control used in web browsers

Generally, HaveAPI replies positively on every OPTIONS request
for existing route (action/version/whole API). HaveAPI::Server
has new method allow_header, using which it's possible to register
headers that will be sent in Access-Control-Allow-Headers. Token
auth uses this.

HaveAPI does not allow HTTP basic auth from web browsers. This may
change in the future.