Adds merge() and keys() methods to Lib.Data.Hash and associated unit test coverage
Refactors CorsHeaders to leverage new merge method of Lib.Data.Hash (which HttpHeaders extends)
Fixes bug in RestEndpoint::isImplemented() which needed to check that the requested method exists before attempting to reflect it
Refactors CORS headers implementation for RestApi and updates example to reflect. Seems to be better aligned with spec now, simpler logic, and does a better job of containing responsibility in the CorsPolicy class.
Cleans up CorsPolicy support for credentialed requests (cookie based, still need auth-based), and adds support for exposed response headers
Adds support (and cheesy example) for CorsPolicy response to authorization (credentialed) requests according to spec; should be solid now