use CORS middleware
allow CORS pre-flight requests to be cached
explicitly specify supported CORS methods
Merge pull request #43 from afeld/cors

use CORS middleware