Normalize CORS API and update docs:

 * fix various typos in documentation
 * make CORS options be functions instead of raw values, for greater flexibility, while retaining sane defaults.
   This concerns ExposeHeaders, SupportsCredentials and MaxAge.
 * refactor empty method check into allowMethod
 * once a request is identified as a CORS request, delete the Access-Control-Allow-Origin header before proceeding