fix(cors): make all headers lowercase, otherwise hapi will overwrite them

Also adjust tests.

* * *

This commit was sponsored by The Hoodie Firm.
You can hire The Hoodie Firm:

http://go.hood.ie/thehoodiefirm