ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug...

... 970641)
I'm not sure I follow your comments there. I've cleaned up variable names a bit, code seems long winded but hopefully clear. I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1116185, I think we should default to CORS being on and the same throughout the whole API.