Enable CORS

OPTIONS routes were added for each resource that allow all origins,
all methods, and all requested headers. The existing routes also
add a header to allow all origins.
Header changes

Switch to having OPTIONS return just Content-Type (that's what
GitHub does). Also, move all the CORS related logic to the
CustomBootstrapper and cleaned up the tests a bit.
Merge pull request #7 from gregoryjscott/cors

Enable CORS