Fixes #522: Added Access-Control-Allow-Credentials to the preflight handler
Make sure pre-flight checks the incoming origin against the whitelist.

Thanks @Acubed
Tests for the CORS preflight
Merge pull request #523 from AsaAyers/master

Fixes #522: Added Access-Control-Allow-Credentials to the preflight handler