Explicitly list acceptable request headers in CORS response

[mbklein]

• Refactor middleware into a single function wrapper to DRY up handlers
• Give test helper explicit access to processRequest for use in setup
• Remove some unused requires

It was my intention to wrap handlers like:

module.exports.handler = wrap(
  async (event) => {
    // ... handler code
  }
);

because I thought it called more attention to the fact that the function was being wrapped. But prettier preferred

module.exports.handler = wrap(async (event) => {
  // ... handler code
});