Set up CORS hander for error responses

/to @ritch 

See https://github.com/strongloop/loopback/issues/575
These three headers are being set in all three tests. Please refactor them into a shared method. Or at least the first two headers (accept & content-type).