Explicitly allow requests from public websites via new header

[killergerbah]

- Chrome now enforces that servers on private networks explicitly
  grant access to public websites using a new header
  "Access-Control-Allow-Private-Network" that should be sent in
  responses to preflight OPTIONS requests.
- This change implements special handling for OPTIONS requests by
  sending all the existing CORS headers along with the new
  Access-Control-Allow-Private-Network header if private network
  access is being requested.
- See https://developer.chrome.com/blog/private-network-access-preflight/
  for more info.

This PR would fix #301

Unfortunately, requestPermission will continue to not work for browsers that send the OPTIONS request, as the browser will now fail such requests due to the CORS check resulting from the OPTIONS response. A real fix for requestPermission could involve bigger change that puts the requestPermission action on a different endpoint, so that the OPTIONS request for that endpoint could serve a separate origin whitelist.

[FooSoft]

Great work, thanks!