Fixed handling of origin when allow_credentials enabled

[TiARETiK]

There are to things to start with:

• OPTIONS requests are not expected to have Origin header.
• OPTIONS responses are not expected to have an Access-Control-Allow-Credentials headers.
• No response may have both Access-Control-Allow-Credentials=true and Access-Control-Allow-Origin=*. (source)

Currently, the master brunch's response to OPTIONS request contains an Access-Control-Allow-Origin= , which is interpreted incorrectly by most browsers. We can't fix it by simply checking for the presence of an Origin header in the request, due to the possibility of sending out both Access-Control-Allow-Credentials=true and Access-Control-Allow-Origin=*. The simple yet correct way to fix that behavior is to specifically check that the request being answered is not an OPTIONS one. Such a check is implemented in this pull request. There is also a test added that checks for incorrect Origins-Credentials behavior.