Add support for CORS in WebMessageHandler

Allow easy support for [Cross-Origin Resource Sharing][CORS] requests by
simply returning a list of hosts on the `cors_allow_origin` method.

[CORS]: http://www.w3.org/TR/cors/