lambda: Use a cloned copy of the CORS headers within the request context.
lambda: Use a cloned copy of the CORS headers within the request context.

Previously, this was leveraging the global CORS header object.  I observed
this while implementing an alternative for #2597.  It appears the previous
implementation had a small risk of returning a different
`access-control-allow-origin` based on concurrent requests happening at the
same time.

While it would have _never_ returned an origin which wasn't specifically
allowed, it does seem like under the right circumstances — barring the
specifics of AWS's execution dynamics — a race condition could have made it
so a different request's `origin` was returned within the
`access-control-allow-origin` header of the current request, which might
have resulted in a failure in more complex multi-`origin` setups.

apollostack/apollo-server