Support CORS preflight requests for POST action, closes #11
Don’t prefix config options with `app_`.
Add mounting options