Decouple the determination of CORS headers 

from the Flask request and response to make future testing simpler.

This will allow me to simplify the tests to have less flask-testing related cruft, and more explicitly unit test the pieces I am interested in. E.G. determining the options under different conditions, and then actually testing the headers returned as a result of different options and request conditions.

Also, sneakily changes behavior if methods is set due to refactor. Implementation now should be w3c compatible.