Unsuccessful preflight passed through

[felixbuenemann]

If a preflight request does not pass the checks, because either Access-Control-Request-Method or Access-Control-Request-Headerscontains values that are not whitelisted, the request is passed up the rack stack. This will usually lead to an exception, because nothing in the stack handles the OPTIONS request.

I think the better behavior would be to return a 403 error.

I also noticed that on a successful preflight request the status code is 200, but I think 204 would be more appropriate.

[felixbuenemann]

I'm not quite sure, what's the best behavior is after reading http://www.w3.org/TR/cors/#preflight-request again. It seems any non-2xx status code is handled as a network error. Another viable option seems to be to return a 2xx status code but omit the CORS headers. In the end both conditions should be counted as a failed preflight check.

[cyu]

Fixed as #106