Allow access to HEAT cfn and cloudwatch api's

Specifically access to port 8000 is now needed for the overcloud to work
on Fedora 18.

Change-Id: Ib683e5c275f10bba3062b1a60da7ff5887b317af