Refine patching of response headers for CORS support
Refine patching of response headers for CORS support

This adds support for Access-Control-Allow-Credentials which is
required for sending cookie data. The -Origin header has been fixed
to echo the origin if allowed for non-safe requests instead of using
the wildcard (*).

The SERRANO_CORS_ORIGIN setting has been deprecated in favor of
SERRANO_CORS_ORIGINS (added an 's' on the end) which is list of supported
origins for CORS. If no origins are defined, all origins are assumed to be
allowed.

Fix #104
rv816/serrano_night,rv816/serrano_night,chop-dbhi/serrano,chop-dbhi/serrano