v0.3.0

This largely completes the ability for a policy module to configure all of the headers in the CORS specification.

Enhancements to policies:

1. Callback for setting the Access-Control-Max-Age header.
2. Wildcard match for allowed origins. This will not set Access-Control-Allow-Origin to "*".