Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
This `def` immediately followed by `@something\n@some_other_thing` is giving me ruby flashbacks.