Respond to options

And add `Access-Control-Allow-Headers` and `Access-Control-Allow-Methods` headers.

See settings added in development.ini.example.