handle CORS pre-flight requests

@sellout, @joneshf: This is correct, according to the documentation, but I have not tested it from a browser yet. I wanted to get it in your hands as soon as possible. Feel free to merge, and then you can test by pointing at the build box, or pull the jar built from the PR by Jenkins, or ask me.

I'm going to try to set up a small in-browser test. Will update with the result.