core: fix CORS implementation to properly handle non simple methods [BREAKING]

Handle following CORS headers:
Access-Control-Allow-Credentials
Access-Control-Allow-Headers

This breaks the StdCORSAuthorizer API, which now uses a builder to define what is allowed.