simplify cors much

I was tyring to hard to protect the resource when really all the spec tells me
to do is add certain response headers if the client opts in to recieve those.

Note in particular that this will not protect your POST view from clients sending
the wrong "Origin:" since CORS relies on a compliant client (a malicious client
could just as well not send an "Origin:" header at all).