Brings js-ipfs into line with go-ipfs by not having CORS on by default,
instead requiring the user to explicitly configure it.

BREAKING CHANGE:

- CORS origins will need to be [configured manually](https://github.com/ipfs-inactive/js-ipfs-http-client#cors)

Co-authored-by: Marcin Rataj <lidel@lidel.org>

Browsers send OPTIONS requests as preflight CORS checks when the
client has done something like specified custom headers.

Removes the blanket 405 handlers in order to use HAPI's default
404 when the preflight request-method is for a resource that does
not exist, though retain the 405 behaviour if a request with a non-POST
or non-OPTION method is actually received.

"The origin server MUST generate an
   Allow header field in a 405 response containing a list of the target
   resource's currently supported methods."

https://tools.ietf.org/html/rfc7231#section-6.5.5

Co-authored-by: Marcin Rataj <lidel@lidel.org>