Fix cors errors

Makes sure Rack::Cors is included before Warden so authentication failures return CORS Headers. Including my test case too since it seemed like a good idea.