ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug...

... 970641)
How about:
- get rid of the `debug` variable entirely
- set `request.CORS` = [request.method] in the `if`
- set `cors_allowed_methods = getattr(request, 'CORS', None)`

Note: you didn't really add this problem, but since you iterate on it below if `fireplacey` is truthy, I don't think this is a good idea to default to `None`...