always allow options requests and set CORS friendly headers on the options response and set right(TM) CORS headers
595878e13a866a6a6642eff2ec8d72f56cb345b8 continued - X-Requested-With header not needed
Merge pull request #2 from pellekrogholt/cors_enabled

Cors final(TM) adjustments