Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
This seems confusing, possibly because `f` is reused. Maybe it would be more clear to one-line it?


```python
return add_cors(api_view(methods)(f))
```