Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
This test seems really similar to the next test but with `get` instead of `options`. Any reason it can't be written with the URL/view you setup for that one?