Respond to OPTIONS requests with CORS headers to allow preflighted requests

Browsers may preflight CORS requests by issuing OPTIONS requests.  They will refuse to perform the request if they don't see the CORS headers.  See: https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Preflighted_requests

In Ogre, Express is using the default OPTIONS handler, bypassing the CORS code.  `curl -XOPTIONS -v 'http://ogre.adc4gis.com/convert'` demonstrates that no 'Access-Control-*' headers are being returned.

This pull request updates Ogre to respond to OPTIONS on /convert and /convertJson by returning CORS headers.  It sets the "Allow" header and response body to "POST" to remain compatible with the current (default) behavior.