Flask returns None allowed methods when 404ing on CORS.

At:
https://github.com/mitsuhiko/flask/blob/master/flask/app.py#L1584

Flask will return an empty list when response is 404. Then, when
rv.allow = HeaderSet([]), Werkzeug will generate a KeyError at
https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/datastructures.py#L936

which resolves to a `None`value returned to Eve. I'm not sure if this is
intended behavior or a issue within Flask/Werkzeug internals.

This update improves the code a little bit so the returned
Access-Control-Allow-Methods is an empty string and not of a string with
None as a value.

Addresses #381.