handle CORS pre-flight requests

Implement OPTIONS method for /query and /data paths, fixing #395
Merge pull request #396 from mossprescott/ready/395

handle CORS pre-flight requests