* CORS headers not sent when an exception is thrown

Replaces error handling in API@handle with a middleware that will catch
throwables. If applied after cors middleware, CORS headers will be
enabled for error messages.

* CORS headers not sent when an exception is thrown

Replaces error handling in API@handle with a middleware that will catch
throwables. If applied after cors middleware, CORS headers will be
enabled for error messages.

Adds a new authorization middleware config option:

    'authorization.allowOpenApiAccessHandler' => function () {
        return false;
    },

Returning false from this operation will disable the OpenAPI endpoint

Fixes #672