1.0.1 -- Don't send 4xx responses

- No need to send 4xx status error responses, because the client is in
  charge of allowing or forbidding the CORS request. We just need to add
  the CORS headers when the client is connecting from an allowed origin.
updated unit tests
housekeeping