Refactor CORS header setting and options determination

This refactor allows for a better separation of parsing of options from App-level configuration variables, resource-specific keyword arguments and default values.

The Vary header is now set as per the suggestion of the [w3 spec](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html) and the behavior of the Rack-Cors middleware