Dynamically allow all CORS requests by echoing back requested headers

[jnicklas]

Instead of hard-coding a list of headers, we simply echo back the requested headers. This way, all headers are permitted. Same thing with the request method.

[coveralls]

Coverage remained the same when pulling 70ae919 on elabs:allow-all-cors-headers into 7826d04 on localmed:master.