Feature/wildcard origin

Hi,
Here's minor change, with a test. I think response.headers['Access-Control-Allow-Origin'] should equal '*' when the service configuration paramter cors_origins contains '*'
Also, the OPTIONS response does not need an "ok" body, so I emptied it.

I hope this could be merged !
Regards.