Add 304 tests for CORS

CORS doesn't specify what to do with a 304 response, but
HTTP specifies that its headers should be combined with
the stored response -- i.e., a 304 should be under the
same CORS policy as the original 200 (unless it changes it).

This is testing to make sure that this is the case, since
many servers (including intermediaries) do NOT add CORS
headers (and some can't -- e.g., intermediary caches).

Future tests might include things like updates to CORS in
those 304s (fancy!).