Defer preflight write headers until after headers are updated

In the preflight case, `res.WriteHeader()` is called before the headers are updated on the response, and thus the headers never make it out to the client.

This didn't show up in the tests, because `httptest.ResponseRecorder` lets you update headers after the response has been written. I added a new type to guard against this use case; the first commit demonstrates the failing preflight test.

The fix is to `defer` the call to write the headers. The second commit includes the fix.