Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
It also looks like a `GET` to this URL should be a `404` since the view is only supposed to support `POST`. If it returning these headers on a `404`? Is that worth testing?