Add Allow-Origin header to the preflight response.

Per https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Preflighted_requests, the preflight response should contain the `Access-Control-Allow-Origin` header.

This pull request adds logic for this along with a corresponding test.