Allow cross-origin requests from whitelisted domains

 - Allow simple requests from the whitelist (cc.allowed_cors_domains config parameter)
 - Allow authenticated requests from whitelist (there's not much in CC that's useful without authentication)
 - Allow any request headers since we're not sensitive to these (echo back the list of requested headers)
 - Whitelist all response headers that we actually send
 - Respond to pre-flight (options) requests for non-simple requests
   - Get/Put/Post/Delete are allowed (and only these are allowed)
   - Content-Type and Authorization request headers are explicitly ok
 - In conformance to the spec, non-matching requests are ignored, matching requests have headers added, matching pre-flight requests return 200 status with no body

[#77484582]

Signed-off-by: Matthew Sykes <matthew.sykes@gmail.com>