Handle Access-Control-Allowed-Headers in CORS preflight

The CORS implementation added by the fix/preflight branch is incomplete. You must also respond to the headers requests. My client (graphiql on chrome) is trying to use a content-type header, and is therefore being rejected.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Headers

Also, kind of surprising that CORS is enabled by default. You may want to put a warning somewhere in the readme!