Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
those tests are a little weird. The request method doesn't matter because of how it's used. For this case, I could make an option() call just for correctness.