Fix CORS headers.

Previous refactoring had left the CORS headers unimplemented for
GETs and HEADs (I think...?) and with an unnecessary function in
the `request` interface. This removes those, and uses the same
`get_cors_headers` function in all responses.
Generalise CORS headers to extra headers.

So it's clear that we can include any headers based the request,
such as 'Connection: close', which we might need for adapting to
Rack's socket hijacking API.