Allow OPTIONS requests on routes that currently accept POSTs

I'm moving the tutorials out of the main streamtools repo. This means they'll get run as a separate webserver on another port, causing any ajax POST request to fail. The tutorials do a few of these, mainly to import patterns and kick off polls. This change adds OPTIONS route handling and returns Access-Control headers as part of apiWrap.