Allow cross-origin OPTIONS requests

[carlbennettnz]

The Access-Control-Allow-Origin header was already being set, but this adds Access-Control-Allow-Methods and Access-Control-Allow-Headers headers and prevents OPTIONS requests from 404ing.

[carlbennettnz]

Whoops, looks like a dup of #13