Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
Is this what you want for `'Access-Control-Allow-Headers'`? It returns two more by default. Seems like this might be an easy way to shoot yourself in the foot.