Fix CORS for st2auth

STORM-862
Replace Auth middleware with hook

This is needed for CORS headers to apply to authentication errors too. Hook is handled after the middleware so request may never reach it.
Handle OPTIONS request correctly
Merge pull request #833 from StackStorm/feature/cors

Fix authentication to support CORS