After a chat with @warp on IRC I will implement answering OPTIONS requests (MBS-6072) that also includes MBS-6033.
I will use this branch as a starting point.
Implementation as a Plack::Middleware module is in general possible, but it might be easier for now to just create an Allow.pm role and merge CORS.pm there. There is no pre-made Middleware module that works with both CORS and "normal" OPTIONS requests.
This review appears to be stuck. Could this be discarded until you have a new review ready?
Done. I will resubmit when the other patch is done. Needs a bit more consideration and possibly tests. So not a "quick fix" like this one.