Cors final(TM) adjustments

always allow options requests and set CORS friendly headers on the options response and set right(TM) CORS headers