Decouple the determination of CORS headers 

from the Flask request and response to make future testing simpler