follow §6.4 of CORS spec

http://www.w3.org/TR/cors/#resource-implementation

“Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in practice generate the Access-Control-Allow-Origin header dynamically in response to every request they wish to allow. As a consequence, authors of such resources should send a Vary: Origin HTTP header or provide other appropriate control directives to prevent caching of such responses, which may be inaccurate if re-used across-origins.”
pass through same origin request in CORS filter
test path exclusions in the CORS filter
factor CORS Filter into both a Filter and ActionBuilder
split CORSFilter file and add scaladoc