cors: handle CORS request for most requests

CORS request can be done outside of an OPTIONS request. The W3C
recommendation says that a preflight request is optional and is not to
be used with many simple requests. For example, a browser requesting a
font is likely to not use a preflight request. Therefore, we need to be
able to handle CORS with GET/HEAD/POST requests (those are the simple
method, other methods requires the use of OPTIONS).

First, we make OPTIONS a simple no-op operation. "OPTION *" is still not
handled correctly but it is not used with CORS requests.

Then, we move the handle of CORS at the end of request dispatching. Only
handler marked appropriately will examine an eventual Origin header to
apply CORS rules. The concerned handlers are for `options-object` (for
OPTIONS), `get-object` (for GET), `head-object` (for HEAD),
`put-object` (for POST as PUT) and `delete-object` (for POST as
DELETE). Other handlers are considered to not being able to be used with
CORS.

Handling CORS mean checking for the Origin header, checking for CORS
rules and then let add the appropriate headers. Otherwise, the request
is not modified.

Errors are also subject to CORS handling.

Unittests have been added for GET.