Proper CORS handling

Gotham currently doesn't allow middleware-based CORS as it is only run when their Router has a match, which is usually not true for OPTIONS requests.

However, with our Resource approach, we know exactly which routes we need OPTIONS for. This means we can add the appropriate OPTIONS handlers, and enable CORS usage for every Resource method. This should however be optional, so we need a way to configure the CORS handler.