Header changes

Switch to having OPTIONS return just Content-Type (that's what
GitHub does). Also, move all the CORS related logic to the
CustomBootstrapper and cleaned up the tests a bit.