Fix cors errors

Makes sure Rack::Cors is included before Warden to authentication failures return CORS Headers. Including my test case too since it seemed like a good idea.