Fix the default CORS options

/to @ritch 

See https://groups.google.com/forum/#!topic/loopbackjs/y7vB4RFDS0E