(#2484) - fix readOnly replication for CORS/40*

Currently we only mark a source database as
read-only if it returns a 401. Really we should
do it for any 40*, and also in the case of CORS
the error status is a deceptive 0, so this doesn't
help.

Ugly hack, but I verified manually that using a
CouchDB that only accepts CORS methods GET and HEAD,
I can now replicate in Safari 7, IE 11, Chrome 36, and Firefox 30.