Refactoring cors function

* I broke out several functions to better follow the SRP.
* I also changed the default for `cors.allowOrigin` from `null` to `*`.
* I discovered and fixed a bug that would result in
  `Access-Control-Allow-Credentials` to always be set to `true`