Skip same-origin requests in CORS catchall, but catch everything else even if no access control header was set
Simplified CORS+CSRF handling
In CSRF hook, added /csrfToken route directly to sails.config.routes so that CORS hook will process it like every other route.  This also allowed simplification of the route handler--no need for more CORS checks since the CORS hook will handle it.
In CORS hook, removed all references to CSRF entirely; it's just another route now.  Also removed code related to sending 403 responses for socket requests on bad origins, since we're doing that for ALL requests now regardless of transport.
Updated CORS/CSRF tests