Remove hokie CORS from handlers

- add a test script for simulating a simple CORS request