Fix CrossDomainMiddleware so that it returns proper allowed methods

[acelaya]

The middleware tries to determine the allowed methods by using the RouteResult::class request attribute, but since the middleware is (and has to be) executed before the routing middleware, that attribute is always null.

When that happens, it falls back to "allow all" HTTP methods, which kind of works, but it's not correct.

It should, instead, try to match the route for the requested path, and infer the allowed methods from there.