Handles options.origin as function

Makes it possible to pass a function as options.origin. The function gets request object as parameter and should return the string for 'Access-Control-Allow-Origin' header, or false to prevent the header from being set.

There is a simple example in the tests.