refactor cors; fix header checks; add Vary:Origin

i split the simple-cors and preflight-cors; this introduces some minor
duplication but is imo easier to read and maintain

also updated the section numbers to most recent spec

also fixed the header name checks - all headers are lowercase if
coming from ringo