v2.7.1354

Implement doOptions, allow origin for download

While testing team-view downloading submissions with authorization I found two things:
- When using the browser fetch command, browsers will sometimes do an HTTP OPTIONS
  request before trying the actual download URL, and if the OPTIONS fails or doesn't
  include all required access-control headers it will fail early without actually
  trying the URL you requested (and which would have succeeded). Implementing
  doOptions on the CDS avoids this failure, and might help with other browser-side
  or other 'overly correct' clients.
- Download responses didn't include the allow-origin header that we set on all other
  responses.