Makes substantial improvements to CorsPolicy, RestEndpoint, and related example. Also adds a merge() method to HttpHeaders (might be useful to add to its parent class Hash instead). More to be done on CORS headers around authenticated requests, etc.