Verifying CORS requests way earlier
Verifying CORS requests way earlier

Especially `OPTIONS` does not require anything else and we can bail out
safely. Also avoids spawning useless sessions.

Cyperghost/WCF,MenesesEvandro/WCF,WoltLab/WCF,Morik/WCF,SoftCreatR/WCF,SoftCreatR/WCF,WoltLab/WCF,Cyperghost/WCF,WoltLab/WCF,Morik/WCF,joshuaruesweg/WCF,SoftCreatR/WCF,joshuaruesweg/WCF,Cyperghost/WCF,Morik/WCF,WoltLab/WCF,Cyperghost/WCF,joshuaruesweg/WCF,Morik/WCF,SoftCreatR/WCF,MenesesEvandro/WCF,Cyperghost/WCF