Creating a `CORS` middleware to set `req.cors` before anything else can run, fixing `proxy()`, deleting CORS headers when not required, fixes #309