add CORSFilter in spring stack

Fixes issue #163
* added CORSFitler as a dependency
* tested the Allow-Origin header


Also fixes bug: customizeContextHandler was never called in AbstractWebTest - so users couldn't customize the test servlet context.